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OVERSIGHT OF THE YEAR 2000 PROBLEM: 
THE Y2K STATUS OF THE DEPARTMENT OF 
HEALTH AND HUMAN SERVICES 


FRIDAY, FEBRUARY 26, 1999 

House of Representatives, 

Subcommittee on Government Management, 
Information, and Technology, 
Committee on Government Reform, 

Washington, DC. 

The subcommittee met, pursuant to notice, at 9 a.m., in room 
2154, Rayburn House Office Building, Hon. Stephen Horn (chair- 
man of the subcommittee) presiding. 

Present: Representatives Horn, Morelia, Biggert, and Turner. 

Also present: Representive Gordon. 

Staff present: J. Russell George, staff director and chief counsel; 
Matt Ryan, senior policy director; Bonnie Heald, director of infor- 
mation, and professional staff member; Mason Alinger, clerk; Paul 
Wicker, Kacey Baker, and Richard Lukas, interns; Michelle Ash 
and Faith Weiss, minority counsels; Ellen Rayner, minority chief 
clerk; and Jean Gosa and Earley Green, minority staff assistants. 

Mr. Horn. The Subcommittee on Government Management, In- 
formation, and Technology will come to order. 

There are only 308 days left to reassure American citizens that 
the computer systems, those that are critical to our lives, are year 
2000 compliant. Unfortunately, even today, many private organiza- 
tions and governmental entities are only now recognizing the po- 
tential severity of this problem. Some are just starting to fix their 
systems, leaving little, if any, time for one of the most important 
aspects of this effort — adequate testing. 

The problem is real, the consequences serious, and the deadline 
is unmovable. 

The House Subcommittee on Government Management, Informa- 
tion, and Technology has focused on the potential problem since 
early 1996. On Monday, our subcommittee issued its seventh report 
card, which showed considerable improvement throughout the Fed- 
eral Government. However, much work still remains. We will con- 
tinue to steadfastly monitor the Federal Government’s year 2000 
readiness and sternly prod those departments and agencies that 
lag behind. 

Today we will hear about the status of year 2000 technology ini- 
tiatives at the Department of Health and Human Services [HHS], 
and one of its key components, the Health Care Financing Admin- 
istration, otherwise known as HCFA. 

( 1 ) 
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Since November, and as shown in our most recent report card, 
HHS has reported substantial improvement in making its mission 
critical systems year 2000 compliant. Currently, HHS reports that 
about 83 percent of its mission critical systems are compliant, due 
in large part to HCFA’s reported increase in mission critical system 
compliance. We look forward this morning to learning how HHS 
righted itself in grappling with its year 2000 issues. 

In addition, we will hear from the General Accounting Office, 
Congress’ auditing arm on program and money, which has been 
doing outstanding work for this subcommittee over the last 3 years 
on this issue. 

The Department of Health and Human Services provides vital 
services to the American public, ranging from health care and food 
safety to AIDS research. In addition, the Health Care Financing 
Administration approves more than $300 billion annually in med- 
ical bills for over 72 million of America’s most vulnerable citizens, 
the elderly, the poor and the sick. But will these payments con- 
tinue on January 1st? How year 2000 ready is HCFA and how 
ready are the numerous health care contractors and providers in- 
volved in Medicare? 

Finally, how prepared are the States for providing Medicaid serv- 
ices to the nearly 35 million people who otherwise could not afford 
to seek medical help. No Federal entity is an island unto itself and 
no Federal entity can be complacent regardless of its Y2K status 
until its partner organizations, in this case the doctors, hospitals 
and the State and local governments, are also adequately prepared 
for the new millennium. HHS is also responsible for processing 
about $170 billion a year in Federal grants through its large pay- 
ment management system. This centralized system processes most 
Federal assistance grants, including block grants, to over 20,000 re- 
cipient accounts. For example, this system processes 98 percent, or 
about $95 billion, of the Federal Government’s share of Medicaid 
grants. The big concern for us in Congress is that this critically im- 
portant system is not yet year 2000 compliant. 

I look forward to delving into these and other highly important 
issues this morning. I welcome today’s witnesses and look forward 
to their testimony. 

We have a total of three witnesses for this hearing and we are 
going to start with panel one, being Joel Willemssen, the Director 
of Civil Agencies, Information Systems, General Accounting Office. 
Panel two will then come up, John J. Callahan, the Chief Informa- 
tion Officer for the Department of Health and Human Services, and 
Nancy-Ann DeParle, Administrator of HCFA. 

I would now like to yield to Mr. Gordon, the ranking member on 
the Committee on Technology of the House Committee on Science. 
The gentleman from Tennessee. 

Mr. Gordon. Thank you, Mr. Chairman. I have a constituent at 
home by the name of Barbara Mandrell. She had a song a few 
years ago entitled, “I Was Country Before Country Was Cool” and 
let me just say that Steve Horn has been singing the problem of 
Y2K long before it was cool, and we owe you a debt of gratitude 
in raising this awareness in our country. I was with the EU last 
week and I was dismayed when we talked with many of their par- 
liamentarians that for some reason they think that this problem is 
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going to go away. I want to thank you for putting this country on 
notice, and I think your report cards help us all to better focus. 

Mr. Horn. I now yield for an opening statement to a new Mem- 
ber from Illinois, the vice chairman of the Subcommittee on Gov- 
ernment Management, Information, and Technology, Mrs. Biggert. 

Mrs. Biggert. Thank you. Chairman Horn. You always start on 
time to the very minute, and we always appreciate that. This cer- 
tainly is an important issue and I look forward to the testimony. 
I think that — how many days do we have now, about 310? 

Mr. Horn. 308. 

Mrs. Biggert. So the year 2000 is not going to wait and I look 
forward to these hearings. And I think that the more hearings that 
we have, the more education that we have on this issue, the more 
that we raise the consciousness of the American people and the im- 
portance for all industry, government, local government and Fed- 
eral Government and State government, to really assure us that we 
are going to be ready for the year 2000. 

Thank you. 

Mr. Horn. Thank you. And we now have as our first witness and 
I think you all know the routine. All of the subcommittees of the 
Government Reform Committee swear in all witnesses, and we will 
start with you, Mr. Willemssen. 

[Witness sworn.] 

Mr. Horn. The clerk will note that the witness affirmed and we 
will begin with this overview and then ask panel two to join us and 
have their testimony, and then it will be essentially a dialog of the 
committee and the witnesses. 

Let me just withhold, the distinguished ranking member from 
Texas, Mr. Turner, is here. Do you have an opening statement? He 
is always a constructive member of this committee. 

Mr. Turner. Thank you, Mr. Chairman. I want to thank you, 
first of all, for holding this hearing, both you and Chairwoman 
Morelia have been active in leadership in this area. 

We are here to discuss the efforts of the Department of Health 
and Human Services to resolve the year 2000 problem. In Sep- 
tember 1998, the General Accounting Office reported that HCFA 
and its contractors were behind schedule in testing, repairing, and 
implementing the systems that support Medicare. At that time, the 
GAO concluded that it was highly unlikely that the Medicare sys- 
tems would be compliant in time to ensure uninterrupted delivery 
of benefits and services. 

Even as recently as February of this year we have learned that 
only 54 of the 78 contractor systems were compliant and 5 of these 
24 noncompliant systems were more than 2 months behind sched- 
ule. We have additionally learned that while HCFA’s contractors 
have made progress, seven are at risk of missing the federally im- 
posed March 31st deadline. 

In addition, HCFA has been in the process of determining wheth- 
er to update its current payment management system or to use a 
new system. The payment management system processes about 
$170 billion annually or about 75 percent of all Federal grant and 
aid programs, and HCFA has chosen to update and maintain this 
system through the year 2000. Given the time spent in making this 
determination, Y2K efforts to test this system did not begin until 
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later than expected, and HCFA will be conducting tests next 
month. 

Further, the ability of HCFA’s computers to communicate with 
non-Federal computers is a very serious concern. HCFA commu- 
nicates with hospitals, physicians. State governments, and its own 
contractors on a daily basis, and if problems arise in these non- 
Federal systems, the communication efforts of HCFA will be ad- 
versely impacted. 

Another area of concern is the area of medical equipment. It 
bears mentioning that the Food and Drug Administration has a 
number of Y2K concerns relating to medical equipment, and as of 
January 12th, only 1,438 of the 1,932 targeted manufacturers had 
submitted Y2K data on their biomedical equipment to the Federal 
Y2K Biomedical Equipment Clearinghouse. 

What this means to the American people is that there are still 
a number of products about which there is not sufficient informa- 
tion to know its Y2K status. A further concern is the fact that the 
majority of manufacturers are not affirmatively notifying users 
that potential problems may exist in their equipment. 

One solution will be to require the manufacturers to notify the 
device users, including hospitals and nursing homes, of other po- 
tential Y2K problems. Still further, there is concern that many con- 
sumers may attempt to hoard prescription drugs at the turn of the 
century, and given the brief shelf life of some prescription medica- 
tions, the FDA must create contingency plans for potential drug 
shortages. 

Before we move into January 2000, it will certainly be necessary 
to find a solution to the problem of shortages of prescription drugs. 
One of HHS’s largest problems is the readiness of State govern- 
ments which administer the various HHS programs. As you know. 
States administer Federal benefits pursuant to Medicare, child 
care, food stamps, and other government programs. The recipients 
of these benefits are often the elderly or the disabled who will have 
limited financial resources or single mothers struggling to make 
ends meet. 

That is why I know that HHS will take the issues of State readi- 
ness very seriously, and I am encouraged to hear that HCFA is 
taking steps to identify and work with those States that have been 
identified as being the furthest behind. State readiness for Y2K is 
a critical concern and one that HCFA should be following closely. 

Also appearing most susceptible to disruptions are the inner city 
municipal hospitals and the rural health care providers. Given 
their geographic locations, rural providers often do not have the re- 
sources of larger institutions, and I am particularly interested in 
hearing what HCFA is doing to ensure that the Y2K concerns of 
our rural health care providers are being adequately addressed. 

I come from a rural district, and I know that rural hospitals and 
rural health care providers need to be confident that HCFA will re- 
imburse them for their services in a timely manner. HCFA has as- 
sured us if a claim gets into the processing system, it will get paid. 
However, Medicare claims are submitted to HCFA contractors ei- 
ther through independent billing agents or directly by providers. A 
claim is only considered in HCFA’s system once it is received by 
the contractor, and I would like to hear more today about how we 
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can ensure that these billing agents and these independent pro- 
viders, such as rural hospitals, will be compliant so that the pro- 
viders can be certain that they will be paid. 

I realize there is much in the system that is out of the direct con- 
trol of HCFA, but I think it is HCFA’s responsibility to be sure that 
those independent contractors are adequately preparing for Y2K. 

Mr. Chairman, thank you again for having this hearing. This is 
probably one of the most critical hearings that we have had and 
with an agency that you and I both know has probably had more 
problems than most of the agencies that we have had before this 
committee. 

Mr. Horn. I thank the gentleman from Texas and since I grew 
up in rural America on a farm, I share your views. Thank you. 

Now, Mr. Willemssen. I think all of the members of the com- 
mittee know this gentleman. He has done a splendid job in his role 
with his team over at the General Accounting Office as Director of 
Civil Agencies Information Systems, and when we have held hear- 
ings throughout the country, Mr. Willemssen has been there with 
the opening statement and we welcome you today. 

STATEMENT OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL 

AGENCIES INFORMATION SYSTEMS, GENERAL ACCOUNTING 

OFFICE 

Mr. Willemssen. Thank you, Mr. Chairman. I will briefly sum- 
marize the readiness of HHS to address the Y2K issue, and in par- 
ticular focus on HCFA and Medicare, and then on the Payment 
Management System. 

First regarding HCFA and Medicare Y2K, we originally reported 
our concerns with this nearly 2 years ago and at that time the level 
of HCFA management attention on Y2K was minimal. Instead 
much of the agency’s system focus was on a failed effort known as 
the Medicare Transaction System which was intended to replace 
existing part A and part B core computing systems. 

As we have previously testified, this effort was terminated after 
about $80 million was spent and not one line of software had been 
delivered. It is important to keep that history in mind as we now 
look at the large challenge that HCFA faces in addressing Y2K. 

We reported last fall that with its very late start on Y2K, HCFA 
faced the prospect of having too much to do in too little time. Many 
of the basic Y2K management practices that we would have ex- 
pected to have seen were not there. Our conclusions and rec- 
ommendations to the Administrator reflected our concern about the 
high level of risk facing HCFA. HCFA has been responsive to our 
recommendations and the Administrator is to be commended for 
making Y2K the agency’s top priority and directing a number of ac- 
tions to more effectively direct the project. Among these many ac- 
tions has been an important commitment to business continuity 
and contingency planning to ensure that in the event of system 
failures, beneficiaries will still receive care and providers will be 
paid. Despite its progress, we still have serious concerns with 
where HCFA is with Medicare and Y2K. 

First, HCFA’s reported external systems progress on Y2K is 
highly overstated. HCFA and HHS recently reported that 54 con- 
tractor systems were compliant as of December 31st. In fact none 
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of these 54 should have heen considered compliant. All had impor- 
tant exceptions, some of them very significant. 

According to HCFA officials they reported these systems as com- 
pliant because the qualifications were minor problems that should 
not take much time to address. This is at variance with the report 
of HCFA’s independent verification and validation contractor on 
about February 16th. At that time the contractor found the quali- 
fications to be critical, most requiring a major to moderate level of 
effort to resolve. 

Among the other issues that HCFA needs to address: One, HCFA 
still lacks an integrated schedule that lays out a critical path for 
the most important tasks that have to be done. 

Two, HCFA has thousands of data exchanges that remain to be 
remediated and tested. 

Three, HCFA faces a tremendous amount of testing for the re- 
mainder of this year, testing both at a system level, for changes to 
resolve the existing qualifications, as well as other legislatively 
mandated changes that will go into effect. All of that testing will 
ultimately determine whether HCFA’s systems are indeed compli- 
ant. Given the magnitude of the challenge that HCFA faces, it is 
absolutely critical that the Administrator sustain her commitment 
to complete and test business continuity and contingency plans so 
that if system failures occur, HCFA will be positioned with backup 
plans. 

Next, let me turn briefly to HHS’s Payment Management System 
and the Program Support Center. As noted, a key activity for this 
center is providing grant payments totaling over $165 billion annu- 
ally to about 20,000 recipient organizations. The payment manage- 
ment system is instrumental to making sure those payments are 
made. However, the system is not yet Y2K compliant and it is un- 
clear at this point when it will be. In 1995 there was an effort 
begun to replace the existing system with a new state-of-the-art 
system that was expected to be Y2K compliant and operational by 
October 1997. However, since its inception, that planned system re- 
placement has encountered problems and as a result is still not 
operational. We understand that the Program Support Center has 
contracted with a company to conduct an analysis of whether to 
rely on the replacement system as the year 2000 solution or rely 
on their existing system and remediate and test that. Regardless 
of the outcome of that analysis, and I believe that HHS may be 
providing the results today, there will be a tremendous amount of 
work remaining to make sure, whether the existing system or re- 
placement system is the solution, that is indeed Y2K compliant. 
That concludes a summary of my statement. I would be pleased to 
address any questions that you have. 

[The prepared statement of Mr. Willemssen follows:] 
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Mr. Chairman and Members of the Subcommittee; 

We appreciate the opportunity to participate in today’s hearing focusing on the readiness of 
the computer systems of tt>e Department of Health and Human Services (HHS) overall and 
of some of its component organizations to function reiiably into the next century. HHS is a 
vast department; its components face varying challenges in making sure that its programs do 
not suffer interrupUon in the delivery of benefits and service upon which millions of 
Americans depend. 

I would like to begin today by summarizing the information contained in HHS' most recent 
Year 20W) (Y2K) quarterly report to the Office of Management and Budget (0MB), reflecting 
progress made as of December 31, 1998. I will then offer more specific comments in areas in 
which we have done work, including the Health Care Financing Administration’s (HCFA) 
Medicare and Medicaid programs, the Administration for Children and Families’ (ACF) state 
human services programs, the Program Support Center's (PSC) Payment Management 
System (PMS), and the biomedical equipment efforts of the Food and Drug Administration 
(FDA). 
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REPORTED COMPLIANCE STATUS OF HHS SYSTEMS 

As the foBowing table illustrates, HHS reported that as of December 31, 1998, 83 percent of 
its mission-critical systems were y2K compliant (243 of 294). Of its 34 systems remaining to 
be repaired, 99 percent were reported to be renovated, 81 percent validated, and 77 percent 
implemented. 


2 
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Table 1: Year 2000 Compliance Status of HHS’ Mission-Critical Systems. December 31 
1998. as reported to 0MB on February 10. 1999 . 


HHS Agency 

Total 

Systems 

Number 

Compliant 

To Be 
Replaced 

To Be 
Repaired 

To Be 
Retired 

HCFA Internal 

25 

25“ 


0 

0 

HCFA External 

82 

54 

0 

24 

4 

ACF 

45 

45 

0 

0 

0 

PSC 

8 

3 

1 

4 

0 

FDA 

34 

30 

4 

0 

0 

IHISH 

100 

86 

5 

6 

3 

Total HHS 

294 

243 

10 
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‘includes lour systems that require additional coordination of internal and external 
interfaces. 

‘includes the Administration on Aging, Centers for Disease Control and Prevention, Health 
Resources and Services Administration, Indian Health Service, National institutes of 
Health, Office of Inspector General, and Substance Abuse and Mental Health Sen/ices 
Administration. 


Source; Department of Health and Human Services' quarterly report to OMB, February 10, 
1999. 
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In addition to the work that remains to correct its mission-critical sj^tems, HHS has much 
work left in the embedded systems, facilities, and telecommunications areas. Specifically, 
according to its February 10, 1999, report to OMB, HHS had (1) assessed about 40 percent 
of its embedded systems (primarily biomedical equipment) and (2) assessed 20 percent of its 
facilities. Further, HHS reported that it had two operating divisions with compliant 
telecommunications systems as well as odiers in varying stages of assessing and/or 
remediating their telecommunications systems. 


MUCH WORK REMAINS TO ACHIEVE COMPLIANCE AT HCFA 

In a report issued last year, we concluded that the progress made by HCFA — and its 
contractors — in making its computers that process Medicare claims Year 2000 compliant 
was severely behind schedule in areas including repair, testing, and implementation! 

Further, we made numerous recommendations to improve key HCFA management practices 
that we foimd to be lacking or inadequate. Today I would like to briefly discuss our findings 
from that report and our suggestions for strengthening HCFA’s Y2K activities, describe 


‘M fidicwg Computer Systenis: Year 2000 Challenges Put Benefits and Services in Jeopardy 
(GAO/AIMD-98-284, September 28, 1998). 
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actions taken on those recommendations, and provide our perepective on where Medicare 
claims processing stands today. I will also provide an update on the status of state systems 
that support HCFA’s Medicaid program. 

Medicare Systems Remain At High Risk 

As the nation's largest health care insurer, Medicare expects to process over a billion claims 
and pay $288 billion in benefits annually by 2000. The consequences, then, of its systems' 
not being Year 2000 compliant could be enormous. We originally highlighted this concern in 
May 1997, making several recommendations for improvement? In our report of last 
September we warned that although HCFA had made improvements in its Year 2000 
management, serious challenges remained to be resolved in a short period of time. 
Specifically, we reported that less than a third of Medicare's mission-critical systems had 
been fully renovated, and none had been validated or implemented. Further, in terms of the 
agency’s key management practices necessary to adequately direct and monitor its Year 
2000 project, HCFA had not 


^ Medicare Transaction System: Success Depends Upon Correcting Critical Managerial and 
Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997). 
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■ developed an overall schedule or critical path to identify and rank '^K tasks to help 
ensure that they could be completed in a ttaiely manner; 

■ implemented risk management processes necessary to highlight potential technical 
and managerial weaknesses that could impair project success; 

■ planned for or scheduled end-to-end testing to ensure that program-wide renovations 
would work as planned; or 

■ effectively managed its electronic data exchanges, thereby increasing the risk that 
Y2K errors would be transferred through data exchanges from one organization's 
computer systems to those of another. 

0MB also had concerns. In its December 8, 1998, summary of Year 2000 progress reports of 
all agencies for the reporting quarter ending November 13, 1998, it concluded that while 
HCFA had made significant progress in renovating its internal and external systems, the 
agency remained a serious concern due to the remediation schedule of its external systems. 
0MB fmther stated that Medicare contractors would have to make an intensive, sustained 
effort to complete vtdidation and implementation of their mission-critical systems by the 
govenimentwide goal of March 31, 1999. 0MB designated HHS as a tier 1 agency on its 
three-tiered rating scale since it had made insufficient progress in addressing the Year 2000 
problem. 

6 
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Our conclusions and recommendations to the HCFA Administrator reflected our concerns 
about the high level of risk and large number of tasks still facing HCFA. We reported that it 
was more critical than ever that HCFA have sound business continuity and contingency 
plans in place that could be implemented should systems failures occur. Our specific 
recommendations included that HCFA 

■ rank its remaining Year 2000 work on the basis of an integrated project schedule and 
ensure that all critical tasks are prioritized and completed in time to prevent 
unnecessary delays, 

■ develop a risk management process, 

■ define the scope of an end-to-end test of the claims process and develop plans and a 
schedule for conducting such a test, 

■ ensure that all external and internal systems' data exchanges have been identified 
and agreements signed among exchange partners, and 

■ accelerate the development of business continuity and contingency plans. 

HCFA's Actions to Aclueve Compliance in i ts Medicare Systems 

HCFA has been responsive to our recomraendatioiB, and its top management is actively 
engaged in its Year 2000 program. HCFA’s Administrator has made Year 2000 compliance 
the agency's top priority and has directed a number of actions to more effectively manage 
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this project. For example, HCFAhas estabiished a “war room" for reaWime monitoring of 
Year 2000 renovation, testing, and implementation activities. In addition, the agency 
established seven contractor oversight teams to monitor progress, HCFA also strengthened 
its outreadi efforts; onJan«aryl2, 1999, the Administrator sent individual letters to each of 
the 1.26 million Medicare providers in the United States, alerting them to take prompt Year 
2000 action on their infoimation and billing systems. Three days later the Administrator 
sent a letter to Congress, with asstirances that HCFA is making progress and stressing that 
physicians, hospitals, and other providers must also meet the Y2K challenge. HCFA also 
offered to provide speakers in local congressional districts. 

To more effectively identify and manage risks, HCFA is relying on multiple sources of 
information, including test reports, reports from its independent validation and verification 
(TV&V) contractors, and weekly status reports from its recently established contractor 
oversight teams. In addition, HCFA has stationed staff at critical contractor sites to assess 
the data being reported to them and to identify problems. 

HCFA is also more effectively managing its electroiuc data exchanges. HCFA now reports 
having a complete data exchange inventory of nearly 8,000 internal exchanges and over 
258,000 external data exchanges. HCFA also issued instructions to its contractors (carriers 
and fiscal intermediaries) to inform providers and suppliers that they must submit Medicare 
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claims in Year 200(k:oropliant data exchange format by April 5 of this year. The status of 
each of these data exchanges is being tracked by HCFA staff. 

HCFA has also more clearly defined its testing procedures. It published additional testing 
guidance in November 1998 that provided a policy for external systems that requires 
multiple levels of testing for each system, including: 

■ Unit level testing testing of the individual software component using test cases that 
exercise all component functionality. For the standard claims processing system, 
this includes full functional testing of claims processing policy and program integrity 
edits. 

■ Simulated fiiture date testing testing ofthe individual software component i^ing 
tools to simulate that the date has been rolled forward. 

• Compliance testing : testing in a fully Year 2000-compliant envirorunent with real 
future dates to verify that the system is Year 2000 compliant. 

HCFA also plans to perform end-to^nd testing with its Year 2000^ompUant test sites. These 
end-to-end tests are to include ail internal systems and contractor systems; however, they 
will not include testing with banks and providers. Finally, HCFA has begun to use a Year 
2000 analysis tool to measure testing thoroughness, and its fV&V contractor is assessing test 
adequacy on the external systems (e.g., test coverage and documentation). 
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The final area in which HCFA has demonstrated progress is developing business contimiity 
and contingency plans to ensure th^ no matter what, beneficiaries will receive care and 
providers will be paid. HCFA has established cross^jiganlzational workgroups to develop 
contingency plans for the following core business functions: health plan and provider 
payment, eligibility and eiuoilment issues, program integrity, managed care, ipraiity of care, 
litigation, and telecommunications. HCFA's draft plans document its business intact 
analysis; the contingency plans are expected to be completed by March 31 of this year, and 
testing of the plans by June 30. 

Reported Status of HCF A's Missin n-Critical Systems 

HCFA operates and maintains 25 internal mission-critical systems. HCFA also has 78 
external mission-critical system^ operated by contractors throughout the country to 
process Medicare claims. These external systems include six standard processing systems 
and the “Common Working File." Each contractor relies on one of these standard systems 


’HHS reported 82 HCFA external mission-critical systems, however, 4 of these are due to be 
retired. 
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to process its claims, and adds its own front-end and back-end processing systems. The 
Common Working Hie is a set of databases located at nine sites that works with internal and 
external systems to authorize claims payments and determine beneficiary eligibility. 

HCFA’s reporting of its readiness for next January sounds quite positive as stated in the 
most recent HHS y2K quarterly progress report to 0MB. According to this report, dated 
February 10, as of December 31, 1998, all 25 of HCFA’s internal mission-critical systems 
were reported to be compliant, as were 54 of the 78 external systems. Figure 1 shows 
HCFA’s reported status, compared with what it reported on September 30, 1998. 
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Figure 1: Reported Status of HCFA’s Missnon-Criticai Systems 



9/30/98 12/31/98 9/30/98 12/31/98 
Internal External 


Source: HCFA quarterly reports to HHS. 
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Reported Progress Is Highly Overstated 

HCFA’s reported progress on its external mission-critical systems is considerably 
overstated. In fact, none of the 54 systems reported compliant by HCFA was Year 2000 
ready as of December 31, 1998. All 54 external systems that were reported as compliant had 
important associated qualifications (exceptions), some of them very significant. Such 
qualifications included a mtqor standard system that failed to recognize “00” as a valid year, 
as well as 2000 as a leap year; it also included systems that were not fully future-date tested. 

According to HCFA officials, they reported these systems as compliant because these 
qualifications were “minor problems” that should not take much time to address. This is at 
variance with the IV&V contractor’s interpretation. More specifically, the IV&V contractor 
found that the qualifications reported by all systems contractors were critical, most 
requiring a mqjor to moderate level of effort to resolve. 

A specific example of a system reported as compliant with qualifications is the Florida 
standard system, used by 29 contractors. This system had one qualification that consisted 
of 22 test failures. The IV&V contractor characterized this failure experience as significant. 
HCFA reports that these failures were corrected with a January 29, 1999, software release. 
However, in a February 16, 1999, IV&V status report. Blue Cross of California— a user of the 
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Florida standard system-found that date test problems remained. In another example, the 
EDS MGS standard system that is used by 10 contractors had 25 qualiflcations; these 
included 9 problems that were not future-date tested. HCFA now reports that future-date 
testing of the January software release of the EDS MGS system is 92 percent complete. 

As these examples illustrate, the systems are not yet Year 2000 compliant, and the 39 
contractors that use these two standard systems likewise cannot be considered compliant. 
Further, according to the IV&V contractor, two critical qualifications associated with each of 
the standard systems affect ail external contractor systems; (1) HCPA-supplied systems that 
contractors use in claims processing were delivered to them too late for required testing to 
be performed; and (2) the claims processing data centers’ hardware, software, and 
telecommunications were not completely compliant. 

The IV&V contractor acknowledges that Medicare claims processing systems have made 
progress toward Year 2000 compliance over the past year, yet the various qualifications 
inevitably mean that some renovation and a significant amount of retesting still needs to be 
accomplished before these systems can be considered compliant To HCFA’s credit, it 
issued a memorandum in early January requesting Medicare carriers and fiscal 
intermediaries to resolve these qualifications by March 31, the federal target date for Year 
2000 compliance. The notice stated that Medicare systems with unresolved Y2K problems 
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affecting claims processing functions must be corrected, tested, and Installed in production. 
As part of our ongoing work for the Senate Special Committee on Aging, we will be 
monitoring the resolution of these qualifications closely. 

Other Critical Risks/Challenges That Remain 

The February 16, 1990, report of HCFA’s IV&V contractor stated that an integrated schedule 
that tracks all mqjor internal systems activities needs to be established. It added that 
system-specific information-including time, test scheduling, and resource considerations- 
needs to be more fully developed in order to achieve a robust, trackable sdreduie. We 
agree. In fact, this is consistent with our previous recommendation that remairling Y2K 
work be ranked on the basis of a schedule that includes milestones for renovation and 
testing of all systems, and that it include time for end-to-end testing and development and 
testing of business continuity and contingency plans.* Such a schedule is even more 
important for the external systems because of their greater number, complexily, and 
interdependencies. HCFA stiU lacks an integrated schedule that identifies a critical path. 


'GAO/AlMD-98-284, September 28, 1998. 
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\rrthout this, it will be difficult for HCFA raaruigement to identify important dependencies in 
this complex eavironraent and to prioritfee its remaining work in the time that remains; 
HCFA also lacks a forma! risk mant^ement process — something to identify all risks and 
their interd^ndencies, assess their impact, e^^Iish time frames for mitigatioit and 
criteria for successful mitigation, and ensure that the criteria are followed. The one system 
that vrss intended to serve as its comprehensive risk mamagement system does not contain 
current information, acconling to the IV&V contractor. 

HCFA*s systems— both internal and external — exchange data, both among fliemselves and 
witti the Common Working File, other federal agencies, banks, Euid providers. Accordingly, 
it is important that HCFA ensure that Y2K-related errors will not be introduced into the 
Medicare program through these data exchanges. As of February 10, 1999, HCFA reported 
that over 6,000 of its 7,968 internal data exchanges were still not compliant, and that over 
37,000 of its nearly 255,000 external data exchanges were not compliant! To ensure that 
HCFA’s internal and external systems are capable of exchanging data among themselves as 


‘On Febnaaiy 2S, 1999, the HCF.A Administrator stated that she wanted us to note that the 
February 10, 19^, HHS quarterly report to 0MB had a typographical error, and that the total 
number of internal data exchanges is 3,4 18 and that 309 of these are still not compliant. 
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well as with other federal agencies, banks, and providers, it is essential fliat HCFA take 
steps to resolve the remaining noncompliance of these data exchanges. 

In yet another critical area, HCFA faces a significant amount of testing in 1989, since 
changes will continue to be made to its mission-critical systems to make them compliant. 
First, changes to resolve the existing qualifications will need to be retested. Second, testing 
must still take place with full production-level software. For examine, the final software 
release of the Common Working File before 2000 is scheduled for late June; testing will 
therefore be needed after that Third, legislatively mandated changes to softv?are that will 
occur through June wUl need to be retested as well. HCFA plans to conduct these final tests 
of its systems between July 1 and November 1, 1999, then recertily ail mission-critical 
systems as compliant without qualification or exception. These final tests will ultimately 
determine whether HCFA's mission-critical systems are indeed Year 2000 compliant The 
late 1999 time frames associated with this testing represent a high degree of risk. 

In addition to such individual systems testing, HCFA must also test its systems end-to-end to 
verify that defined sets of interrelated systems, which collectively support an organizational 
core business function, will work as intended. As mentioned, HCFA plans to perform this 
end-to-end testing with its Year 2000 test sites. These tests are to include all intemal 
systems and contractor systems, but will not include testing with banks and providers. 
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HGFA has instructed its contractors that it is their responsibility to test with provideis and 
financial institutions. Even excluding banks and providers, end-to-end testing of HCFA’s 
internal and external systems fe a massive undertaking that will need to be effectively 
planned and carried out HCFA has not yet, however, developed a dialled end-to-end test 
plan that explains how ttiese tests will be conducted or that provides a detailed schedule for 
conducting them. 

A final aspect of testing concerns the independent testing contractor. The IV&V contractor’s 
recent assessment of the independent testing contractor concluded that its strategy as 
currently stated “is high risk for providing effective independent testing” because of the 
limited number of internal systems to actually be independently tested; 8. This number vras 
previously 22. Further, this testing will not be completed until August. The limited number 
of systems tested and the late completion date are not reassuring. 

Given the magnitude of HCFA's Year 2000 problem and the many challenges that continue to 
face it, the develt^ment of contingency plans to ensure continuity of critical operations and 
business processes is absolutely critical. Therefore, HCFA must sustain its efforts to 
complete and test its agencywide business continuity and contingency plans by June SO. 
Another challenge for HCFA is monitoring the progress of the 62 separate business 
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continuity and contingency plans that will be submitted by its contractors. We will continue 
to monitor progress in this area. 

Other issues that further complicate HCFA's Year 2000 challenge are the known and 
imknown contractor transitions that are to take place before January 1, 2000, and the 
unknown status of the managed care organizations serving Medicare beneficiaries. As 
reported in HHS’ quarterly submission to 0MB, HCFA is concerned about the possibility of 
Medicare contractors, fiscal intermediaries, and carriers leaving the program and notifying 
HCFA after June 1999. If this were to occur, the workload would have to be transferred to 
another contractor whose Year 2000 compliance status may not be known. According to 
both contractor and HCFA officials, it requires 6-12 months to transfer the claims processing 
workload from one contractor to another. At present, HCFA must transition the work of 
three carriers that are leaving the program. 

HCFA is requiring the 386 managed care organizations currently serving 6.6 million 
Medicare beneficiaries to certify their systems as Year 2000 compliant by this .^ril 15. 

These certifications may be qualified, just as with the fee-for-service contractors. If this 
were to occur, a formal recertification would have to be performed later this year. Until this 
initial certification is performed, it will remain unknown whether the managed care 
organizatiotts’ ^sterns are Year 2000 compliant 
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To summaiize HCFA’s Medicare situation, the agency and its contractors have made 
progress in addressing issues that we have raised. However, their reported progress vastly 
overstates the facts. Some renovation and a significant amount of testing must stili be 
performed this year. Until HCFA completes its planned recertification between July and 
November 1999, the final status of the agency’s Year 2000 compliance will be unknown. 
Given the considerable amount of remaining work that HCFA faces, it is crucial that 
development and testing of HCFA’s business continuity and contingency plans move 
forward rapidly if we are to avoid interruption of Medicare claims processing next year. 


In fiscal year 1997, Medicaid-a joint federal-state program supported by HCFA and 
admini^red by the states— provided about $160 billion to millions of recipients. Medicaid 
provides health coverage for 36 million low-income people, including over 17 million 
children. Its beneficiaries tdso include elderly, blind, and disabled individuals. 
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In surveying stales’ Year 2000 status last summer ,* we found that many systems were at risk 
and much work remained to ensure the continuation of services. The states’ reported 
compliance rate for Medicmd systems was only about 16 percent mid 18 states reported that 
they had completed renovating one quarter or fewer of their Medicaid claims processir^ 
systems. Hiese 18 states had Medicaid expenditures of about $40 billion in fiscal year 1997- 
one-quaxter of total Medicaid expenditures nationwide, covering about 9.5 million 
recipients. 

Since last summer, HCFAhas administered two state seif-reporHng surveys and conducted 
several on-site visits, finding that overall state Medicaid systems status has improved IMe. 
For example, HCFA reported in November 1998 that Medicaid systems had shown some 
progress in renovation, but that the number of states reporting completion of this phase had 
actually decreased compared with the July/August 1998 data that were reported to us by the 
states. It found, further, that 1 1 states’ Medicmd systems were still reported to be 25 percent 
or less renovated, and about half of the states were 50 percent or less renovated. Only five 


"Year 2(XX) Computing Crisis: Readiness of State Automated Systems to Support Federal 
Welfare Programs (GAO/AIMD-99-28, November 6, 1998). We sent a survey to the SO sW»s, 
the District of Columbia, and three territories (Guam, Puerto Rico, and the Virgin Islands). 
All but one of the 54 entities surveyed responded. 
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states — Arkansas, California, Idaho, liiinois, and Iowa — reported their Medicaid systems to 
be 100 percent renovated. Thus, while 0MB guidelines target completion of systems 
renovation by September 1998, states’ self reported data to HCFA showed that about 90 
percent of states had not completed renovation for the Medicaid programs as of November 
1998. 

To obtain more reliable Year 2000 state Medicaid status information, HCFA hired a 
contractor to conduct independent verification and validation of states’ systems. As an 
initial effort, the contractor and HCFA distributed a survey to all states to ascertain 
background and Year 2000 status information. However, based on more recent information 
from on-site visits, the IV&V project ieader said that the survey data were not as reliabie as 
HCFA had expected because states tended to overstate their progress. As a result, HCFA 
has instead decided to rely on on-site contractor visits to ascertain accurate Medicaid 
systems status. 

HCFA reported in HHS’ February 1999 quarterly report to 0MB that based on seven site 
visits, some of the dates that states had reported to us last July/August had slipped, 
underscoring the need for on-site visits to secure more accurate information. For example, 
according to HCFA, while four states appeared to have made some progress in the 6 months 
since our survey, the status of three states remained the same. Further, HCFA found that 
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one state’s Medicaid eligibiiity system was not as far along as the state had reported. As of 
February 17, 1999, HCFA told us that it had vfeited 14 states and that half of those states had 
shown some improvement. Thus, HCFA and the IV&V contractor plan to make on-site visits 
to ail 60 states and the District of Columbia by the end of this April. For states considered at 
risk, HCFA will conduct second site visits between May and September 1999 and, if 
necessary, third visits between October and December. The later visits will emphasize 
contingency planning to help the states ensure continuity of program operations in the event 
of systems failures. 


CURRENT STATUS OF STATE SYSTEMS SllPPOR'nNG ACF PROGRAMS IS UNKNOWN 

Key state-administered programs that could be affected by Y2K include Temporary 
Assistance for Needy Families (TANF), Child Support Enforcement pSE), Child Care (CC), 
and Child Welfare (CW) programs; these programs-critical to the health and well being of 
the needy — are overseen by HHS’ ACF. These programs focus on providing benefits to 
economically needy families with children who lack financial support &om one or both 
parents because of death, absence, incapacity, or unemployment. In fiscal year 1997, federal 
and state agencies spent just under $14 billion on cash and work-based assistance. Of this 
total, almost $8 billion was federal money, while just over $6 billion was state-funded. 

These programs served almost 8 million recipients as of September 1998. 
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Failure to complete Year 2000 conversion activities for these programs could cause billions 
of dollars in benefits payments to fail to reach our nation’s needy families. Those newly 
approved for benefits could face an inability to be automatically added to the recipient file; 
eligibility for new applicants might not be able to be determined in a timely fashion; eligible 
recipients could be denied benefits; and payments could be underpaid, overpaid, or delayed. 

As figure 2 illustrates, our November 1998 report on the Year 2000 readiness of state systems 
that support these programs found that, although progress varied, many systems were at 
risk and much work remained to ensure continuation of services! 


'GAO/AIMD-99-28, November 6, 1998. 
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Figure 2: Percentage of Systems Reported Comnliant. -July/ August. MPS . 


Percent of Systems 



□ Compliant 

□ Not Compliant 


Programs 


Following our report, 0MB implemented a requirement that federal oversight agencies 
include the status of state human services systems in quarterly Year 2000 progress reports. 
Specifically, it requested that federal agencies describe actions to help ensure that federally 
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supported, state-run programs will be able to provide services and benefits' 0MB has 
further asked that agencies report the date when each state’s systems will be Year 2000 
compliant, and provide information on any significant difficulties that states are 
encountering. 

ACF is currently surveying the states to determine the status of TANF, child support 
enforcement, child care, and child welfare systems, however, it does not have current 
information on states’ systems. In response to OMB’s requirement to provide updated state 
systems status in the quarterly Y2K progress reports, ACF sent letters and surveys to state 
Chief Information Officers asking for such information, requesting that states to return the 
survey by January 31, 1999. As of February 16, 1999, ACF had received responses from 27 
states. Further, according to HHS’ Year 2000 program manager, the information provided by 
the states raised more questions than answers; some states did not answer all questions or 
complete the survey for all systems. 


'OMB Memorandum for the Heads of Selected Agencies, Revised Reporting Guidance on 
Year 2000 Efforts, January 26, 1999. The state programs included were Food Stamps, 
Medical Assistance, Unemployment Insurance, TANF, Child Support Enforcement, WIC, 
Low Income Home Energy Assistance, Child Nutrition, Child Care, and Child Welfare. 
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ACF is now proposing on-site reviews of state systems for TANF and the child support 
enforcement, child welfare, and child care programs in all 50 states. ACF sees these reviews 
as enhancing the available information concerning states’ Year 2000 readiness and providing 
a vehicle through which the agency can provide states with technical assistance. ACF is 
considering developing a process similar to the one being used by HCFA, or possibly 
working with HCFA in gathering information. 


STATUS OF PSC’.s PAYMF.NT MANAGEMENT .qY.STEM 

HHS’ PSC provides grants payments and cash management services through its Payment 
Management System (PMS) to all HHS agencies and to 10 other federal agencies on a fee- 
for-service basis. PSC is organized into three business units, referred to as “services”. Each 
service is responsible for a particular line of business. 

■ The Administrative Operations Service’s responsibilities include property management; 
distribution of pharmaceuticals; medical and dental supplies; information systems 
support; and technical information services. 

■ The Financial Management Service is responsible for providing financial services such 
as grants payments and cash management. 
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■ The Human Resources Service is responsible for providing a full range of human 
resources services such as personnel operations and payroll. 

A key PSC activity is providing electronic funding and cash management service to 
organizations receiving HHS grants and contracts, as well as grants from other federal 
agencies. Its list of federal customers includes the Departments of Agriculture, Energy, 
Interior, Labor; and the Federal Emergency Management Agency, the Corporation for 
National Service, the National Aeronautics and Space Administration, the Social Security 
Administration, the Agency for International Development, and the U.S. Information Agency. 
According to PSC, its customer environment also includes 12 HHS operating divisions, and 
about 20,000 recipient organizations; 

■ 2,900 universities and educational organizations; 

■ 7,500 hospitals, health, and nonprofit organizations; 

■ 3,800 state government agencies; and 

■ 6,300 cross-servicing recipients. 

These recipients receive about $165 billion armually in federal grants payments for a wide 
range of activities such as school lunch programs, highway construction, and health care. 
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PSC has identified eight mission critical systems spanning the diversity of its administrative, 
financial, and human resources activities: 

■ Commissioned Corps Personnel and Payroll System, 

■ Civilian Payroll and Persoimel System, 

■ Automated Payment and AcUustmenl System, 

■ Debt Collection System, 

■ 6ESS Telephone Switch, 

■ PSC LAN Servers, 

■ Payment Management System, and the 

■ CORE Accounting System. 


Of PSC’s eight mission-critical systems, the Payment Management System is one of the most 
crifical. However, this system is not yet compliant, and it is unclear when it will be. 
Developed for the purpose of creating a central system for paying most federal assistance 
grants, block grants, and contracts, the main purpose of PMS is to serve as a fiscal 
intermediary between awarding agencies and the recipients of grants and contracts. PSC 
uses PMS to process billions of dollars in payments to recipient organizations-over half of 
all federal grant payments. Indeed, it is PMS that makes available to states approximately 
$96 billion in Medicaid payments annually. 
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PMS was originally created 30 years ago, and has been expanded and modified several times 
since, according to PSC. In 1996, PSC began a project to replace PMS with a new, state-of- 
the-art automated system known as the “Reengineered Payment Management System”. It 
was anticipated that this new system would be Year 2000 compliant and operational by 
October 1997. 

Since its inception, the plarmed system replacement has encountered problems and, as a 
result, is still not operational. For example, according to a December 1997 PSC status 
report to HHS, the original contractor for the replacement system failed to maintain the 
agreed-upon schedule and therefore PSC decided to hire another contractor to implement 
the system. With the new contractor, the estimated date to complete the new system was 
revised to October 1, 1998, which was not met 

Problems appear to continue to plague the new system replacement effort For example, in 
its biweekly status report for the period ending February 12. 1999, the contractor reports 
that portions of the implementation strategy are in Jeopardy due to problems with database 
extracts fimm the existing system. The contractor is concerned that database extracts, if 
transitioned to the new system, “may contain hidden surprises.” 
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Despite the new system’s problems, the Director of (he Division of Payment Management 
told us that he expects the new system to be operational and Year 2000 compliant by March 
31, 1999. Nevertheless, because PSC was concerned that it was at risk of not having a fully 
tested compliant system, it contractedin January 1999 for an independent consulting firm to 
conduct an analysis of whether PSC should rely on the new replacement system as its Year 
2000 solution or, instead, rely on remediation and testing of the existing payment 
management system. According to the Division Director, this analysis was due on February 
23. The Division Director stated that, as of this date, he had not received the final report. 
According to the firm contracted by PSC, whichever option PSC pursues, program 
management and independent verification and validation support will be required for the 
successful complrtion of the project 


SOME BIOMEDICAL EQUIPMENT STATUS iNFORMATION AVAILABLE THROUGH FDA 

The question of whether medical devices such as magnetic resonance imaging (MRI) 
systems, x-ray machines, pacemakers, and cardiac monitoring equipment can be counted on 
to work reliably on and after January 1, 2000, is critical to our nation’s health care. To the 
extent that biomedical equipment uses embedded computer chips and software, it is 
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vulnerable to the Y2K problem.’ Such vulnerability carries with it possible safety risks. This 
could range from the more benign — such as incorrect formatting of a printout— to the most 
serious — such as incorrect operation of equipment with the potential to decrease patient 
safety. The degree of risk depends on the role the equipment plays in the patient’s care. 

Responsibility for oversight and regulation of medical devices, including the impact of the 
Y2K problem, lies with FDA. It provides information from biomedical equipment 
manufacturers through an Internet World Wide Web site. Last September!’ we reported that 
FDA had a disappointing response rate from biomedical equipment manufacturers to its 
request for compliance information. The FDA biomedical equipment database also lacked 
detailed information on the make and model of compliant equipment. Further, FDA did not 
require manufacturers to submit test results certifying compliance. Therefore, the adequacy 
of manufacturers’ corrections of noncompliant equipment could not be assured. 


’Biomedical equipment refers both to medical devices regulated by FDA, and scientific and 
research instruments, which are not subject to FDA regulation. 

“Year 2000 Computin g Crisis: Compliance Status of Many Biomedical Emiinment Items Still 
Unknown (GAO/AIMD-98-240, September 18, 1998). 
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To address these issues, we made lecoinmendations to the Secretaries of HHS and Veterans 
Affaire (VA)~a key stakeholder in detemuning liie potential effects of the century change on 
biomedical equipment-to detemune what actions, if any, should be taken regarding 
manufacturers that have not provided compliance information. We also recommended that 
the departments (1) work jointly to develop a single data clearinghouse to provide 
compliance information to all users of biomedical equipment, and (2) take prudent steps to 
review test results for critical care/life support biomedical equipment, especially equipment 
once determined to be' noncompliant but now deemed compliant-and make those results 
publicly available through FDA’s central data clearinghouse. 

HHS and VA agreed with our recommendation to develop a single data clearinghouse. FDA, 
in conjunction with VA, has established the Federal Y2K Biomedical Equipment 
Clearinghouse; it is publicly accessible through the Internet site and contains infonnation on 
biomedical equipment compliance submitted to FDA by manufacturers, as well as 
infoimation gathered by VA and the Department of Defense as part of their Year MOO 
compliance projects. FDA also plans to include detailed Information on the make and 
model of equipment reported as compliant 

In its February 10, 1999, quarterly submission to 0MB, HHS reported that as of January 12, 
1999, about three quarters (1,438) of 1,932 biomedical equipment manufacturers identified 
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by FDA had submitted data to the clearinghouse. As shown in figure 3, about 40 percent of 
the manufacturers have products that do not employ a date, while about 17 percent reported 
equipment having date-related problems. 
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Figure 3: Biomedical Compliance Status Information Reported 
To FDA by Manufacturers as of Jamiarv 12. 1999 



Note: Total number of manufacturers = 1,438. 
Source: Department of Health and Human Services. 
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Last September we also reported that most manufacturers citing noncompliant products 
iisted incorrect display of date and/or time as the Y2K problem!’ According to VA, these 
cases may not present a risk to patient safety because health care providers, such as 
physicians and nurses, can work around the problem. Of more serious concern are 
situations in which devices depend on date calculations, which can be incorrect. One 
manufacturer cited an example of a product used for planning delivery of radiation 
treatment using a radioactive isotope as the source. An error in calculating the strength of 
the radiation source on the day of treatment could result in a dose that is too high or too 
low, which could have an adverse effect on the patient."^ 

HHS reports that FDA will continue to explore ways of obtaining compliance information 
from manufacturers who have not yet replied. In response to our recommendation that FDA 
and VA review test results of manufacturers’ compliance certifications, VA-deferring to 
HHS-stated that it did not have the legislative or regulatory authority to do this. HHS, for its 
part, said that it lacked the available resources to undertake such a review and, further, that 


“GAO/AIMD-98-240, September 18, 1998. 

‘ Vear 2000 Computing Crisis: Leadership Needed to Collect and Disseminate Critical 
Biomedical Eouioment Information (GAOfr-AIMD-98-310, September 24, 1998). 
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insufficient time remained to complete such reviews before 2000. We believe that if HHS 
lacks sufficient resources to review manufacturers’ test results, it may want to solicit the 
help of federal health care providers and profeffiional associations. Finally, HHS stated that 
submission of appropriate certifications of compliance is sufficient to ensure that the 
certifying manufacturers are in compliance. We disagree. Through independent review's of 
manufacturers' test results, users of medical devices are provided with a greater level of 
confidence that the devices are indeed Year 2000 compliant. 


Mr. Chairman, this completes my statement 1 would be pleased to respond to any questions 
that you or other members of this Subcommittee may have at this time. 


C511739) 
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Mr. Horn. I thank the gentleman. I note that the chairman of 
the Subcommittee on Technology of the House Committee on 
Science has joined us and before we begin the questioning, if the 
gentlewoman from Maryland would like to make an opening state- 
ment. 

Mrs. Morella. Thank you, Mr. Chairman. You invited me to 
participate in this hearing and I appreciate it very much. It is part 
of our ongoing series of meetings that we have had, and briefings, 
to make sure that all agencies recognize the urgency and the time 
limits on correcting the year 2000 computer problem, computer 
glitch, mother of all computer glitches. Certainly my hope is that 
given what we understand from the General Accounting Office 
about the serious difficulties that HCFA is experiencing with Y2K 
that we can spur the agency to undertake the dramatic actions that 
are needed to ensure that the population who receive over $170 bil- 
lion annually of Medicare and Medicaid assistance, that their elder- 
ly, disabled and indigent benefits continue uninterrupted. 

Last September GAO reported that “HCFA and its contractors 
were severely behind schedule in the repairing, testing, in the im- 
plementing of its mission critical systems that support Medicare.” 
And the General Accounting Office also noted that “due to the com- 
plexity and magnitude of the problem and HCFA’s late start, its 
progress in repairing mission critical Medicare systems is far be- 
hind schedule.” 

I know that HCFA disputes some of the General Accounting Of- 
fice’s conclusions. I know that both HHS and HCFA have dem- 
onstrated a great deal of progress in this last quarter, so I look for- 
ward to continuing the dialog and hearing our other witnesses and 
questioning Mr. Willemssen. 

Thank you very much, Mr. Chairman. 

Mr. Horn. I thank the gentlewoman. We will begin with the 
questioning for 5 minutes alternating between the majority and mi- 
nority side. There are not too many questions to ask the General 
Accounting Office. We will then move to panel two and have Mr. 
Willemssen rejoin the panel at the end and have some more ques- 
tioning. 

Let me yield the chairman’s time to the vice chairman of the 
committee, Mrs. Biggert, the gentlewoman from Illinois. 

Mrs. Biggert. Thank you, Mr. Chairman. 

Mr. Willemssen, in the Department’s quarterly report to the Of- 
fice of Management and Budget, the Health Care Financing Ad- 
ministration [HCFA], reported that 54 of its 78 external mission 
critical systems were year 2000 compliant. However, in your testi- 
mony you said that none of these 54 external mission critical sys- 
tems are completely compliant because they have important quali- 
fications or exceptions associated with them. Do you think that 
these qualifications are important and if so, why? 

Mr. Willemssen. Yes, we do think the qualifications are impor- 
tant. The essence of making systems Y2K compliant is in part 
making sure that they are forward date tested so that dates such 
as January 1, 2000, February 29, 2000 will indeed work as in- 
tended and therefore within that testing it is important that those 
kinds of issues have been fully resolved. At this point they have 
not. Also, as of December 31st, the evidence we saw was that all 
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of these 54 had important qualifications requiring some amount of 
effort in order to resolve. If indeed they involved minor effort, I 
would have expected that they would have been fully resolved and 
tested over the last 2 months. In fact they have not. They continue 
to be outstanding. So although some resolution has taken place, 
they still all need to be tested. HCFA is making excellent progress 
but not as much progress as is reflected in those statistics. 

Mrs. Biggert. In your opinion then would you say that HCFA 
is trying to gain the system, trying to improve its grade by over- 
stating the Y2K compliance? 

Mr. WiLLEMSSEN. I would say that HCFA is under tremendous 
pressure to do the best job possible on Y2K. The Administrator has 
made it the top priority. There are a lot of people at HCFA working 
very hard, as are many contractors. I guess it is subject to interpre- 
tation what they saw with the February 16th independent verifi- 
cation and validation contractor’s report that they could possibly 
consider the system substantially compliant, and therefore close 
enough, let’s call that compliant. 

We differ with that view. We thought those exceptions were sig- 
nificant enough that those systems should not be considered com- 
pliant at that point in time. 

Mrs. Biggert. Thank you. Then turning to the Health and 
Human Services Payment Management System which processes 
about $170 billion a year in Federal grant payments, of concern is 
that HHS has been trying to develop a new Payment Management 
System since 1995, as you mentioned, but with little success, but 
it is also still renovating the current system to try to make it Y2K 
compliant. Is the current system year 2000 compliant now? 

Mr. WiLLEMSSEN. No. We have not seen the test results for the 
existing system demonstrating that it is indeed compliant, and I 
believe HHS will be talking about that a little bit today about 
whether they are going to rely on the existing system or the re- 
placement system. But the evidence that we have seen is that no, 
that it is not compliant at this point in time. 

Mrs. Biggert. How about by March 31, 1999 which is the Presi- 
dent’s deadline? 

Mr. WiLLEMSSEN. In discussions over the last few days with 
some of the key officials within HHS, at least one official main- 
tained that he thought it would be compliant by March 31st. I be- 
lieve HHS may be amending that in testimony today to possibly 
being a few months later. 

Mrs. Biggert. Since — how about the new system, will it be ready 
by March 31st then? If it is, what are they going to do with the 
old system? 

Mr. WiLLEMSSEN. This is an issue that several agencies have en- 
countered. The difference with HHS is that this is a bit late to be 
encountering this, and in some cases agencies decide on a dual 
track approach. That is, let’s continue with the replacement system 
but with the risk involved with that replacement system of being 
delivered so late, we need to go into the existing system just in case 
and remediate and test that one so in the event the replacement 
does not get in in time, we have this one to fall back on. We would 
not disagree with that kind of approach overall. 
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Mrs. Biggert. ok. How much then is the Department spending 
to develop the new system and to fix the existing system to make 
it Y2K compliant? 

Mr. WiLLEMSSEN. We do not have up-to-date information on the 
cost that we have gathered over the last couple of days, but we can 
supply the information for the record. 

Mr. Horn. We will insert that at this point in the record. 

[The information referred to follows:] 



48 


April 12, 1999 

Summary of HHS’s Payment Management System Redesign Costs* 

Based on a March 22, 1999, report supplied by HHS’ Division of Payment Management 
(DPM), DPM reported that the: 

• Original estimated cost = $4.60 million 

• Current cost = $6.87 million 

The amount over the original estimate = $ 2.27 million. 


Source: HHS, Program Support Center, DPM. 

Note: These cost figures have not been audited or reviewed by GAO. 


As of March 22. 1999, 
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Mrs. Biggert. Thank you. 

Mr. Horn. I defer the questioning to Mr. Turner, the ranking 
memher of this subcommittee. 

Mr. Turner. Thank you, Mr. Chairman. 

I would like to inquire a little bit into — HCFA has a unique prob- 
lem in that it deals with a lot of folks that it doesn’t have direct 
control over, such as its contractors and the States. What is the 
hammer in terms of legal control that HCFA has over its inde- 
pendent contractors to be sure that they get their systems in com- 
pliance, or are we just hoping that they will? 

Mr. WiLLEMSSEN. I think it is an excellent point that you raise. 
It is one of the unique challenges that HCFA faces that many other 
organizations don’t, in that they have to apply tremendous pres- 
sure on the contractors to get these systems compliant. 

One of the excellent steps that they have taken is hiring the 
independent verification and validation contractor to go in and help 
them make sure that the systems are compliant, and I think that 
contractor has shown some definite value over the last few months. 

But I think the legal issues, I won’t pretend to know them inside 
and out, but there are apparently some legal impediments that the 
Administrator may be more attuned to speak toward. I know the 
administration has put forward some contractor reform legislation 
that it believes will in part assist them in that area. 

Mr. Turner. So we really don’t know if a contractor who is sup- 
posed to be sending out these payments to all of these providers, 
if they are not ready on January 1st and their systems go down, 
we don’t really know if the Federal Government and HCFA can 
hold them legally responsible for those noncompliant acts or wheth- 
er we can hold them liable for damages? Do we even know what 
we can do if a contractor does not get in a situation where they are 
compliant? 

Mr. WiLLEMSSEN. With that legal question I would prefer to 
defer to the Administrator since I do not know the legal intricacies 
that well in terms of what the Federal Government can and cannot 
do. 

Mr. Turner. Another similar issue is the one that you described 
regarding the new system that was going to handle the payment 
management system, the computer that apparently was acquired 
and put in place or attempted to be put in place I believe you said 
in 1997. Now they have decided well, that is not Y2K compliant so 
we are going to stay with the old system through 2000. Who pro- 
vided that system, and do we know if there were representations 
made at the time to HCFA that was going to be Y2K compliant? 

Mr. WiLLEMSSEN. The documentation that we got from HHS indi- 
cated that Y2K would not be an issue once the new system went 
in. Among the problems — I don’t have the contractor names at my 
disposal — ^but among the issues that came up is HHS decided to go 
with another contractor after the initial contractor because of some 
of the problems that they were experiencing and the initial con- 
tractor not being able to meet the schedule. So for implementation 
of the system, HHS went with a second contractor to do that. 

Mr. Turner. To put in the new system? 

Mr. WiLLEMSSEN. Yes, to implement that new system. 
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Mr. Turner. Do we know if that contractor represented that that 
system they were providing to HCFA was going to be Y2K compli- 
ant? 

Mr. WiLLEMSSEN. We can look — once we get the documents from 
HHS, we can look at the contractual language to see if indeed the 
standard Y2K compliance language was in there. The timing of 
that would be — it may or may not have been. We will look at that 
for you, though. There was some standard governmentwide Y2K 
compliance language that was pulled together over a year ago now, 
so it would be interesting in terms of that particular contract to see 
if that language has been put in or potentially an amendment put 
into the contract subsequent to its initial award. 

Mr. Turner. I would certainly hope as late a date as 1997, 1998, 
when all of this occurred, that that language would have been in 
there. 

Mr. WiLLEMSSEN. 1997, from a governmentwide perspective gen- 
erally speaking that language may not have existed. It was still 
being debated during most of that year. 

Mr. Turner. We are having a lot of hearings on Y2K liability, 
and I think sometimes as we discuss that subject we fail to remem- 
ber that the Federal Government itself may be a potential plaintiff 
making claims against contractors who have failed in a legal duty 
to provide systems that are Y2K compliant. 

If you looked at HCFA’s serious problems from the perspective 
of those contractors, when we say that there are serious noncompli- 
ance problems, give us an example of something you found that you 
are calling a serious noncompliant problem? 

Mr. WiLLEMSSEN. One thing in looking at the seriousness of the 
issue is the tremendous complexity of the entire claims processing 
process and it involves so many players with so many individual 
systems and so many data exchanges that you have to look at it 
as a building block type of approach. Each of those individual com- 
ponents we first have to get compliant. And once we have ascended 
that mountain, then we have to look at it from an end to end proc- 
ess involving multiple systems and data flows and making sure 
that that process end to end is compliant, and that is one of the 
primary reasons for our concern about the high risk at HCFA. It 
is not that they are not doing what they can, it is that there is a 
relatively limited amount of time left to get it all done. 

Mr. Turner. Thank you, Mr. Chairman. 

Mr. Horn. Thank you. I now yield 5 minutes to the gentlewoman 
from Maryland for questioning. 

Mrs. Morella. Thank you, Mr. Chairman. 

We rely very heavily on the General Accounting Office and we 
thank you very much for doing the kind of reporting and the inves- 
tigative work that helps us move forward. I can’t think of anything 
more important than Medicare and Medicaid and then the whole 
medical field when it comes to compliance of Y2K. 

I am kind of — I had a concern very much about those many con- 
tractors who are out there and how you pull it together. But I am 
also concerned as I look at the testimony or the statement that 
came, the GAO report, that deals with Medicaid specifically, the 
fact that HCFA distributed a survey to all of the States to ascer- 
tain their background on Y2K compliance, and they then decided 
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they would rely on because they didn’t feel that this was accurate 
enough or complete enough, rely on onsite contractor visits to as- 
certain accurate Medicaid systems status. They then go on to say 
that some States appeared to make progress in the 6 months since 
the survey that had been made, but many of the others — four 
States made progress, three States remained the same. This says 
something about the monitoring and a whole question about what 
more needs to be done, how do we get a handle on this because 
again of the end to end and the many connections that have to be 
made for total compliance and reliability. I ask you — would you like 
to comment on it? 

Mr. WiLLEMSSEN. Yes. Medicaid systems overall are of great con- 
cern. When we issued our report last year on State human services 
systems, the compliance rate that we saw for Medicaid systems na- 
tionwide was only about 16 percent of all of those Medicaid systems 
self reported to us by States. So that definitely was of concern. 

HCFA has taken some excellent steps since then. Part of that 
being hiring a contractor to go out and do on-site visits to see if 
the States are making the progress that they need to. HCFA’s in- 
tent is to go to all States and then for those States deemed at risk, 
to have followup visits. 

We think those are excellent steps that need to be taken, but 
overall Medicaid has a long ways to go. These are not simple sys- 
tems that are going to need to be made compliant. HCFA is taking 
some aggressive steps to try to assist, and again they are to be 
commended for doing that. 

Mrs. Morella. So basically what HCFA has done is hired con- 
tractors to go 

Mr. WiLLEMSSEN. To see how the States are doing. 

Mrs. Morella. Do you feel that HCFA is going to be able to 
meet that March 31st deadline for compliance before the end-to-end 
testing begins, in all candor? 

Mr. WiLLEMSSEN. I doubt that they will be able to make the 
March 31st deadline from the perspective that we would see all 
those systems renovated and tested and certified compliant. I don’t 
think that they will be able to make the March 31st deadline. 

Mrs. Morella. What do you think the consequences will be and 
what do you think we should do about it? 

Mr. WiLLEMSSEN. The consequences of that are that the addi- 
tional — as you mentioned the end to end testing, the period for that 
will get squeezed tighter; and, therefore, the thoroughness and 
depth of that testing will not be as much. HCFA has made an ex- 
cellent commitment toward the need to put together contingency 
plans so that they have backup. 

Mrs. Morella. I would assume that contingency plans are al- 
ready there and have been worked on. Am I assuming too much? 
Do they not have contingency plans? 

Mr. WiLLEMSSEN. They are aggressively working on those plans 
currently. 

Mrs. Morella. Which means that they do not have them yet? 

Mr. WiLLEMSSEN. Their timetable I believe is to have them done 
and tested I believe by approximately the end of June, so that will 
give them some time. From a governmentwide perspective, that is 
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not out of the realm of what the deadline should he for doing that. 
That is pretty good. 

Mrs. Morella. Do you see something more that Congress can do 
to encourage, forge, require? What else can we do? These are sys- 
tems that so many people statistically, as we have mentioned, are 
affected by? 

Mr. WiLLEMSSEN. One, it is important to continue to have this 
kind of oversight on a critical program such as this to keep up to 
date on what kind of progress and impediments there are for Medi- 
care. 

Second, I think you should also ask the question of HCFA, what 
do you need from us? What is getting in your way? Whether it is 
some of the legal issues that we discussed earlier, that contractor 
reform is necessary because we can’t get the contractors to do what 
we tell them if indeed that is the case. I think that is a very useful 
question to ask of HCFA also. 

Mrs. Morella. Thank you, Mr. Willemssen. My time is up. 

Mr. Horn. Thank you very much. I now yield to the ranking 
member of the House Science Subcommittee on Technology, Mr. 
Gordon of Tennessee. 

Mr. Gordon. Thank you, Mr. Chairman. 

Welcome, Mr. Willemssen. I want to thank you and the General 
Accounting Office for the important role that you have played in 
the oversight and watchdog of all of these agencies. As I think you 
just mentioned, the more oversight, the more we can talk about 
this and bring it out, the better off we are. 

Let me ask you, do you feel that Congress has provided adequate 
funds or enough funds for HCFA to maximize their effort to correct 
this problem? 

Mr. Willemssen. I am not aware at HCFA or actually any other 
agency where they have made requests for funds for Y2K and those 
requests have been denied. 

So again an extremely useful question to ask of HCFA, do you 
need more resources, more funds because at many of the hearings 
that I have testified at, that is a common question asked of many 
agencies. If you need more resources, please tell us and we will do 
what we can. 

As you know, last year the Congress passed a $3.35 billion emer- 
gency fund so that agencies such as HCFA and others could tap 
into that fund if indeed they needed those additional resources. 

Mr. Gordon. Thank you. I will ask that question later. 

Let me ask you also. Chairman Horn’s report card I think has 
been helpful in trying to raise awareness of the problem. If you had 
your own report card and you were grading the focus and the at- 
tention that HCFA is placing on this problem, what grade would 
you give? 

Mr. Willemssen. If we were grading in terms of the current 
focus of what HCFA is placing on this problem, given that the Ad- 
ministrator has named it her No. 1 priority and given that many 
of her staff are working on it, it is hard to give less than a top 
grade given where the priority stands within HCFA and given the 
kind of progress they have made since our September report. 

Mr. Gordon. Thank you, Mr. Chairman. 
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Mr. Horn. We are now going to bring forward the second panel. 
We are going to swear them in and then Mr. Gordon will have the 
honor of introducing the members. 

[Witnesses sworn.] 

Mr. Horn. The clerk will note that both witnesses have affirmed 
the oath, and I yield to Mr. Gordon to introduce the panel. 

Mr. Gordon. Thank you, Mr. Chairman. We have all sat through 
a number of hearings with well-informed witnesses, but you don’t 
really know them, I don’t think that their testimony is as real 
sometimes, so I want you to get to know these two folks a little bit 
better. 

First, John Callahan. Dr. John Callahan and I first met almost 
20 years ago when he served as a very Yankee chief of staff to a 
very southern Senator and even with that impediment he did a 
very good job partly because there are a lot of lawyers around here, 
but not too many doctors or PhDs. 

Mr. Horn. Will the gentleman yield. When I hear that I am re- 
minded of the great line of William White, who covered the Senate 
for the New York Times, who said, “The Senate is the South’s re- 
venge on the North for having lost the Civil War.” 

Mr. Gordon. Well, John did a good job there. And then he went 
over to Assistant Secretary in HHS. When there became an open- 
ing at Social Security, they needed somebody to fill in, and John 
went over and did a very competent job of being the acting Director 
of Social Security; and now he has become at HHS an Assistant 
Secretary and John, I am glad you are here. 

And Nancy-Ann DeParle is a good friend from home, an old 
friend from home. And let me tell you about Nancy-Ann. She grew 
up with her mother in Rockwood, TN, and Rockwood is just about 
as tough as the name sounds. Nancy-Ann was fortunate enough to 
get a scholarship to go to the University of Tennessee and I think 
UT feels it was a good investment because Nancy-Ann became the 
first woman student body president of their 20,000-plus campus in 
its almost 200-year history, and became a Rhodes Scholar and went 
on to Yale, graduated with honors from law school and turned 
down offers all around the country to come home, and I am glad 
she did. 

After she got home and she was trying to pay off some bills, our 
Governor asked her to be his commissioner for human services, and 
Nancy-Ann really didn’t have any background in the health care 
area, but she knew how to get things done. So she became the 
youngest and the shortest member of Governor Border’s cabinet, in- 
stituted a number of new information systems that tremendously 
reduced the error rate in food stamps and the welfare program, 
went back to the private sector and then Leon Panetta gave her a 
call and said we hope you will come to 0MB to head up our health 
care area. She did, did a very good job and then was appointed the 
Director of HCFA. 

And it was interesting at the time she got that appointment 
Chairman Morelia and I had our first hearing on the Y2K problem, 
and so I wrote Nancy and said we just had this hearing, and I 
think there is a potential for a real problem and you ought to check 
HCFA and see what is being done. 



54 


She called me later, somewhat frustrated that virtually nothing 
had been done. I don’t think there is a conversation that we have 
had since then that we haven’t discussed her focus. And with all 
of them, the new responsibilities that Congress has placed on 
HCFA, Nancy -Ann has made this her first priority. I know that 
daily she works at it and worries about it and tries to get a handle 
on it. 

I am glad that she is here to give us her experiences, and I have 
to say that really Nancy -Ann to me epitomizes all that is best 
about the American dream in this country. 

Mr. Horn. We thank you for that delightful introduction and we 
thank the witnesses for being with us. However you would like to 
proceed, please do. 

STATEMENTS OF NANCY-ANN DEPARLE, ADMINISTRATOR, 

HEALTH CARE FINANCING ADMINISTRATION; AND JOHN J. 

CALLAHAN, CHIEF INFORMATION OFFICER, DEPARTMENT 

OF HEALTH AND HUMAN SERVICES 

Ms. DeParle. Thank you. Chairman Horn, Congressman Turner, 
and distinguished committee members. We appreciate the oppor- 
tunity to be here today to talk about the progress of the Health 
Care Financing Administration in meeting the year 2000 challenge. 
I have with me Dr. Gary Christoph who I brought in from Los Ala- 
mos National Laboratory a year ago to lead our information tech- 
nology efforts. 

We have a great deal to do, Mr. Chairman, but we are making 
good progress and we will be ready well before January 1, 2000. 
Our main job is financing the health care for Medicare bene- 
ficiaries. We can assure that our claims processing and payment 
systems work and that doctors and hospital bills will get paid, but 
continuity of care depends on much more. Doctors, hospitals and 
other providers must ensure that they are also ready. We are 
therefore engaging in an unprecedented outreach effort to help our 
partners reach their responsibilities. 

Just 2 months ago I personally wrote each and every one of the 
1.3 million health care providers in the country who work in the 
Medicare program to make sure that they were aware of this prob- 
lem and to give them information about what they needed to do to 
be fixing it, and we will also be doing special outreach to critical 
access providers and Medicare sole providers to make sure that 
they are ready. 

We have aggressively attacked our part of the problem, and I 
have to say to Congressman Gordon, it seems like it has been 
about 10 years since we had that conversation, but you are exactly 
right. It is my No. 1 priority. We have to continue to retest systems 
and refine contingency plans, but I do think that we have come a 
long way since I became Administrator. 

To get to this point, we had to make some difficult decisions, in- 
cluding delaying implementation of some of the Balanced Budget 
Act provisions and I want to thank the committee for your leader- 
ship and support in helping us make those decisions. We did reach 
a significant milestone in December when we reported that all 25 
internal mission critical systems are now compliant, and those in- 
clude the systems. Congresswoman Biggert, that pay Medicaid 
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claims and managed care claims. They are the systems under our 
direct control. And, Mr. Chairman, you and I had a conversation 
about the complexity of this, and you remembered from your expe- 
rience on the Senate side how Medicare was set up with all of the 
different contractors around the country, and that has been a big 
part of our problem, as has been noted this morning. 

One of the first things that I did when I got to HCFA was sit 
down with Joel Willemssen and Gene Dodaro from GAO to ask 
them what I needed to do, and they made a couple of recommenda- 
tions. One was to amend the contracts that we have with our con- 
tractors to require them to be compliant by the end of December 
of last year. That turned out to be more difficult than it sounds. 
The contractors initially said no, they were not going to sign it. 
They testified to the Ways and Means Committee that they didn’t 
think that I had the authority to require that, and, in fact, under 
the contracts that Medicare has that are different than any other 
government contracts, there have been questions about the author- 
ity that the Secretary and I have to hold them compliant for things 
like this. But we did in fact succeed in getting a contract amend- 
ment. And by the end of December 31, 1998 we had certified that 
78 of the external mission critical systems had been renovated, in 
other words the 50 million lines of code had been repaired, and 54 
had been self-certified as compliant. That meant that they had 
completed three levels of testing by December 31, 1998. 

Let me stress that self-certification does not mean that our work 
is finished. It does mean that the software has been renovated and 
tested and that those systems were able to process and pay claims 
with future dates. 

We have greatly appreciated, and I have personally benefited 
greatly from, the diligence of GAO in advising us on this project. 
But as you heard this morning, there is a difference of opinion be- 
tween us and our colleagues at GAO on the exact nature and ex- 
tent of the qualifications that we received with the self-certifi- 
cations from the contractors. 

And I want to note that there has been some discussion of our 
December submission and I brought with me just the pages that 
relate to this, from a letter to you in early February that contained 
4 or 5 pages of what the qualifications were on the 24 contractors 
that we did not accept. The GAO believes that all of the qualifica- 
tions should have been removed before certifications were accepted. 
We believe that the qualifications that we allowed were minor and 
don’t go to the heart of the claims processing, and as I said, we out- 
lined each and every contractor that we thought had a problem 
that was significant enough that we were not going to accept their 
certification. 

I directed our staff to be very conservative. With all respect to 
you, Mr. Chairman, I care about your grade, but I care much more 
about making sure that the systems are renovated and tested prop- 
erly and there is no disruption in services. I was not looking to in- 
crease my grade. I was looking to be as conservative as we could 
be. We went on-site at all of these places. We didn’t just look at 
the paper qualifications. And we believe that these contractors 
have made the kind of progress that we needed to note to you at 
that time. 
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We are continuing to closely monitor this situation and we have 
established a war room in our Baltimore headquarters. We have 
special teams of people who have been asked to leave their homes 
and work at these contractors so that I know, frankly, on day-to- 
day basis what is actually happening on the ground. And we are 
developing comprehensive business continuity and contingency 
plans in case any unforeseen problems arise. We are through our 
third draft of our proposed plan, and we plan to have that done in 
June. 

The GAO and our IV&V contractor have identified essential work 
that remains for all of our systems to be millennium-ready, and we 
agree with the GAO that one of the most critical tasks is testing 
our many data exchanges to make sure that all of our inter- 
dependent systems function together properly. 

We also have to continue end to end testing from the point of 
claim submission to the point of sending a payment instruction to 
a bank and printing a notice to a beneficiary. And we have to con- 
tinue working with providers, and this is the area where Congress 
can help us the most. 

After I wrote a letter to each and every one of the providers, I 
also sent every Member of Congress a copy of that letter and asked 
for you to help us. We have speakers available to go out to your 
districts and meet with providers. We will do whatever will help. 
We are also meeting with providers here and with the trade asso- 
ciations, and we want to get out across the country. 

The good news is that we have given providers a deadline by 
when they have to submit compliant claims, and many of them are 
already doing so. About 98 percent of the submitters who submit 
on the part B side are submitting compliant claims right now. And 
on the part A side, from December to January, it increased by 
about 30 percent. We are at 58 percent there. 

So that is the good news, but we also are going beyond current 
industry practice on testing and everything else. We are now in- 
structing our contractors across the country to begin testing with 
those providers around the country who want to submit future date 
claims to test that. 

We hope that will build provider confidence. If they want to test 
claims, they can do so. For especially critical systems, we are going 
another level beyond the GAO’s guidance by having the inde- 
pendent contractor perform independent tests in isolated future 
date environments. 

We also have to finish, test and refine our contingency plans and 
we are doing that in accordance with the GAO’s advice. 

In short, Mr. Chairman, we have much more to do and we fully 
expect that there may be bumps in the road, but I want to assure 
you that we are committed to doing everything we have to do. This 
is our No. 1 priority. All of this would have been a lot harder with- 
out your leadership, Mr. Chairman, and without Congress’ support, 
and I want to thank you for that as well as for the hard work that 
our colleagues at GAO continue to do on our behalf, and I am 
happy to answer your questions. 

[The prepared statement of Ms. DeParle follows:] 
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Testimony of Nancy-Ann DeParle, Administrator 
Health Care Financing Administration 
on the 

YEAR 2000 CHALLENGE 
before the 

House Government Reform 
Subcommittee on Government Management, 

Information, & Technology 
February 26, 1999 

Chairman Horn, Congressman Turner, distinguished committee members, thank you for im-^ting 
me here today to discuss my highest priority - the Year 2000 computer challenge. I am harpy to 
report today that, despite serious concerns about the Health Care Financing Administration’ s 
(HCFA) ability to meet this challenge, we are making remarkable progress. In fact, I am 
confident that HCFA’s own Year 2000 systems issues will be resolved well before Januar\' ' . 
2000 . 


Our foremost concern has been, and continues to be, ensuring that our more than 70 million 
Medicare, Medicaid and Children’s Health Insurance Program (CHIP) beneficiaries continue to 
receive the health care services they need. We are aggressively addressing Year 2000 issues in 
those systems over which we have responsibility. And we are engaging in an unprecedented 
outreach effort to raise awareness and provide information to those other pans of the health care 
system where we have little authority and control. I want to personally assure beneficiaries that 
the care they have come to expect from our programs will continue throughout the millennium 
transition. 

Although our Year 2000 work is not yet complete, we have already accomplished a great deal. 

► All 25 of our internal mission-critical systems are now certified as Year 2000 compliant, 
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three months ahead of the govemment-wide deadline of March 3 1, 1999- 
► All 78 of our external mission-critical claim processing systems that our claims processing 
contractors use to pay bills are renovated. Of these, 54 have been self-certified as 
compliant. Our independent verification and validation (IV&V) expert contractor has 
rated 17 systems as highly compliant and will require only a minimal effort to resolve any 
remaining issues; another 39 will require a moderate level of effort. We will recertify all 
mission-critical systems before October 1999. 

• And 27 of our 55 non-mission critical internal systems are certified as compliant. 

We recognize the importance of our programs to our beneficiaries and have put together a 
vigorous Year 2000 program, with extensive testing and independent review. We have asked our 
IV&V contractor to set rigorous performance measures and be hard in their judgment of our 
contractors’ progress. 

As mentioned above, 54 of our external contractors’ claims processing systems are self-certified 
as compliant. We and our IV&V contractor have noted that this does not mean our entire claims 
processing environment is completely ready. It does mean that the software for these systems has 
been renovated and made compliant, and that the systems have been proven, by extensive testing, 
to be able to pay claims with future dates. These renovated systems are currently implemented for 
claims processing. Self-certification of these systems’ compliance was a critical milestone in 
becoming Year 2000 ready. 


2 



60 


V^e acknowledge that not evety piece of hardware, nor every system that does not go to the hean 
of claims processing is compliant. However, for 54 of the 78 systems, we are confident that the 
qualifications are not substantial enough to warrant a non-compliant status. Our IV&V 
contractor agrees with us. 

For the remainder of 1999, we will continue to renovate, test, and retest our systems. We are 
ahead of schedule on our internal mission-critical systems, and are well on our way to meeting the 
Federal government’s deadline for our external systems. We will certainly be ready before 
January 1, 2000. 

I want to be clear about what HCFA can and cannot do. We are responsible for financing health 
care for our beneficiaries. We can assure that our claims processing and payment systems will 
work and that doctors and hospital bills will be paid. Ensuring continuity of care for our 
beneficiaries, however, goes well beyond processing payments successfiilly. It depends on a host 
of other entities ensuring that their own systems are compliant, such as States, doctors, hospitals, 
and other service providers. And it depends on the continued operation of pharmaceutical and 
medical supply chains, as well as basic utility and telecommunication services. HCFA does not 
have the authority, ability, or resources to step in and fix systems for others, such as States and 
providers. And that leads to a rather substantial concern that we need the help of Congress and 
others to fully address. 
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HCFA’s Year 2000 Efforts 

There is no question that we have faced an uphill battle in achieving Year 2000 compliance. A 

number of key steps are getting us where we need to be. They indude: 

» Building a “War Room” in our Baltimore headquarters dedicated solely to tracldng Y ear 
2000 efforts on a daily basis not only within our own agency, but also with our partners 
across the country I can now find out what is happening on any of our essential Year 
2000 projects at a moment’s notice. That is something I could not do last year. 

>- Establishing contractor oversight teams specifically responsible for closely monitoring 
and managing Year 2000 work for all contractors involved in processing Medicare claims. 
These oversight teams include staff who are on-site overseeing and helping contractors 
who most need assistance in meeting the March 31, 1999, deadline. They also provide 
timely information on the status of contractors’ progress to the War Room. 

^ Negotiating amendments to contracts with more than 60 claims processing contractors. 
These amendments established, for the first time, clear requirements that contractors must 
meet for their information systems to be Year 2000 compliant. 

» Hiring AverStar, Inc., formerly Intermetrics, Inc., an IV&V contractor to provide 
assurance that our Year 2000 work is done right. They have helped us refine our 
renovation processes, audit our testing plans and processes, as well as measure our 
progress. 

► Hiring Seta Corporation, another contractor providing independent testing of especially 
critical systems, to further ensure that the Year 2000 work on these systems has been done 
correctly. This additional testing goes beyond that described by GAO. 
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► Helping States by hiring another IV&V contractor, TRW, to visit every state and validate 
their Year 2000 progress. TRW is giving us direct information regarding the status of 
States’ renovation efforts on critical areas, such as Medicaid enrollment and claims 
processing systems. We also are providing the States with whatever information and 
insights we can. 

► Helping providers learn what they must do to prepare for the new millennium through an 
unprecedented provider outreach campaign. This broad effort includes mailings, 
publications, an Internet site, a speakers’ bureau, a number of seminars and conferences, 
and a wide range of other efforts. 

Scope of HCFA’s Year 2000 Workload 

The Year 2000 especially affects the programs HCFA administers because of our extensive 
reliance on multiple computer systems. More than 1 SO different systems are used by HCFA in 
administering the Medicare program. About 100 of these systems are considered mission-critical. 
These systems are responsible for establishing beneficiary eligibility and making payments to 
providers, plans, and States. 

Medicare is the most automated health care payer in the country. We process nearly one billion 
claims annually, most electronically. In fact, 97 percent of inpatient hospital and other Medicare 
Part A claims and 8 1 percent of physician and other Medicare Part B claims are submitted 
electronically to the Medicare claims processing contractors. Most claims are processed to 
payment by entirely electronic means. This high level of electronic billing has allowed us to 
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achieve significant operating efficiency and cost savings. This reliance on automated systems, 
however, has made the Year 2000 computer fix a major challenge. Critical dates in computerized 
claims processing include the date a beneficiary became eligible, the date a patient was admitted 
or discharged from a hospital, the date a wheelchair rental began, or the date an enrollee entered a 
managed care plan. 

Renovating all these systems has been complicated. Each system used by our programs and our 
60-plus claims processing contractors, as well as interfaces with State Medicaid programs, 
banking institutions and some 1.3 million providers has to be thoroughly reviewed and renovated 
by those responsible for each particular system. Our renovation standards require that systems be 
tested individually, as well as with the exchanges they perform with other partners. 

To fix the Medicare systems alone, we have had to renovate some 49 million lines of internal and 
external systems code to find date-sensitive processes. We have had to repair all of our 
Medicare-specific software so it will work with new versions of vendor-supplied software. We 
have had to update the operating systems that drive the hardware we use with millennium 
compliant versions. We also have had to test and upgrade deficient operational hardware, 
including our telecommunications equipment and software. And we must assure that all data 
exchanges with thousands of our partners will function properly. 

Contingency Planning 

Although we fully intend to have our own systems ready long before January 1, 2000, we know 
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we must be prepared in case any unanticipated problems arise. VVe are undertaking an extensive 
effort to develop contingency plans for all our mission-critical business processes. Our top 
priorities in developing these plans are to: 

► Process claims so as to be able to pay providers promptly; 

► . Prevent payment errors and potential fraud and abuse; 

Ensure quality of care; and 

► Enroll beneficiaries. 

Contingency planning is an Agency-wide effort with active participation of all of our most senior 
executives. We are closely following the GAO’s advice on contingency planning which they 
outlined in their August 1998 guidance. Year 2000 Business Continuity and Contingency 
Planning and in their September 1 998 report. Medicare Computer Systems -Year 2000 
Challenges Pul Benefits and Services in Jeopardy. 

We recently completed the second phase of the contingency planning process by reviewing 280 
Medicare business processes, performing risk and impact analyses, and identifying the potential 
impact of mission-critical failures. We are now in the third phase in which we will clarify and 
document our contingency plans and implementation modes, define events that will trigger use of 
the plans, as well as establish and train implementation teams should the need arise to execute the 
plans. 
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Protecting Beneflciaries 

I must stress that our concern must always be focused first and foremost on protecting the 
beneficiaries and their continued access to care. Providers who fail to fix their own systems, and 
thus are unable to bill us for services, are strictly prohibited from billing beneficiaries. 

Beneficiaries are legally protected from liability for bills that Medicare would ordinarily pay, even 
if the provider is not Year 2000 compliant. To safeguard beneficiaries in the new millennium, we 
will provide them with a phone number to call to report any inappropriate billings they receive 
from providers or any difficulties they encounter in accessing care. Our beneficiaries are counting 
on us. Their health care needs will continue regardless of what day it is. 

Concern for States and Providers 

It is not enough for HCFA alone to be ready for the Year 2000. Health care provider computers 
and systems must be Year 2000 compliant in order for providers to be able to generate and submit 
bills to us. State computers and systems also must be Year 2000 ready for Medicaid and CHIP to 
continue uninterrupted payment of services. Many States and providers will meet the Year 2000 
challenge on time. However, monitoring by us and the General Accounting Office (GAO) 
indicates that some States and providers could well fail. This is the first time any of us have had 
to deal with such a problem, and we at HCFA are eager to share the lessons we have learned 
along the way. We are providing assistance to the extent that we are able. But that likely will not 
be enough. This matter is of urgent concern, and literally grows in importance with each passing 
day. 
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Our own progress in meeting the Year 2000 challenge is due in large part to the outstandina 
effort and commitment of staff throughout HCFA and at our Medicare contractors. We have 
been greatly aided by wise counsel from the GAO, and especially by the expen IV&V contractors 
we hired, based on the GAO’s recommendations, to ensure that our Year 2000 work is done 
correctly. And, importantly, we could not have come so far so quickly without the timely support 
and fimding that Congress has provided. 

Providers’ Progress 

Providers must ready their own systems for the Year 2000 in a timely manner if the heahh care 
system is to meet the millennium challenge completely and successfully. One of the first steps, 
and perhaps the easiest, is changing the format of Medicare claims to allow for 8-digit date fields. 
Our electronic claims monitoring indicates that over 98 percent of Part B claims submitters (either 
physicians/suppliers or their billing agents) are submitting claims with 8-digit date fields. Fifty- 
eight percent of Part A submitters (hospitals and other institutions or their billing agents) that 
submit claims electronically are also using the 8-digit fields. 

It is essential that all providers address the Year 2000 issue. Thus, we recently announced that 
we would require all claims submitters to start using the 8-digit date format by April 5, 1999. 
Claims received on or after that date without the new format will not be accepted. That does not 
mean that providers need to be fully compliant by April 5, but it does mean that we want to be 
assured that they have started to prepare their systems by, at least, taking this first step. 
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We recognize that providers should be able to test whether Year 2000-compliant claims can be 
accepted by our claims processing contractors. We are now instructing our claims processing 
contractors to begin testing with those providers throughout the countn.' who want to submit 
future-dated claims. 

We are concerned that providers address other Year 2000 issues as well, not just billing and 
claims system issues. To ensure continued patient care, providers must take appropriate Year 
2000 remediation steps to prepare biomedical devices, as well as clinical and other systems. 

Provider Outreach. 

Due to the critical need for providers to become Year 2000 compliant, we have launched a broad 
outreach campaign. Last month, in an unprecedented step, we mailed a letter to all 1.3 million 
providers serving our beneficiaries explaining the gravity of the Year 2000 problem and providing 
a checklist for what must be done to achieve compliance. 

Our provider outreach campaign features a special Year 2000 Internet site, www.hcfa.gov/Y2K, 
which includes some of the basic steps that can be taken by a Medicare provider or supplier, such 
as: 

• Preparing an inventory of hardware and software programs and identifying everything that 
is mission-critical to their business operations; 

• Assessing the Year 2000 readiness of their inventory as well as options for upgrading or 
replacing systems, if necessary; 
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• Updating or replacing systems important to business operations, if necessary; 

• Testing existing and newly purchased systems and software and their interfaces; and 

• Developing business continuity plans for unexpected problems. 

Our Internet site also includes links to other essential sites for providers, such as the Food and 
Drug Administration’s Internet site on medical device compliance. 

We have developed a speakers’ bureau with staff trained to make presentations and answer 
questions on Year 2000 issues around the country. We are leading the Health Care Sector of the 
President's Council on Year 2000 Conversion, which includes working closely with provider 
trade associations and public sector health partners to raise awareness of the millennium issue and 
encourage all providers to become compliant. .And our claims processing contractors are olFerii® 
providers Year 2000 compliant electronic billing software for free or at minimal cost. 

1 was pleased that some provider associations have recently announced their intention to assess 
the Year 2000 readiness of their membership and to step-up educational efforts on the critical 
nature of this problem. This is an essential undertaking. Quite simply. Year 2000 compliance 
cannot be a one-way street. Providers also most meet this challenge head on, or risk not being 
able to receive prompt payment from Medicare, Medicaid, or virtually any other insurer. 

We welcome Congress’ help in making providers aware of the Year 2000 and ener^zing them to 
address their part of the problem. I invite you to help us identify opportunities to get the Year 
2000 message across and encourage you to stress the importance of this issue when you meet 
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with providers. As I mentioned previously, we have established a special Year 2000 speakers' 
bureau with staff around the country prepared to speak and offer guidance. You may want to 
have them join you when you meet with providers, and let others know that they are available. 

States’ Progress 

Our concern for States is as great as our concern for providers. For both, we do not have the 
authority, ability, or resources to step in and fix their systems for them. Our ten regional offices 
are monitoring the status of each State’s remediation effort. We also have an expert FV&V 
contractor, TRW, to assist us in conducting on-site visits in every State to provide advice and 
validate assessments. This allows us to maimain an accurate picture of each State’s progress. We 
have already done on-site visits in 16 States and the District of Columbia and expect to visit the 
remaining States by the end of April. The preliminaiy reports confirm earlier work by the GAO 
which strongly suggests that some States will not be ready on time. 

We have asked all Medicaid and CHIP Directors to: 

► Report the status of their Year 2000 compliance efforts; 

Document contingency plans for systems that may not be compliant; and 

► Provide updates to HCFA’s regional offices on States’ progress. 

It is each State’s responsibility to take the steps it believes are appropriate to meet the needs of its 
Medicaid and CHIP beneficiaries. Our primary role is to assess, as best we can, each State’s 
progress and to provide guidance. While we do not have the authority, ability, or resources to fix 
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State systems, we can and do want to help. In addition to furnishing the services of TRW. we 
have developed technical assistance documents, and held regional meetings and workshops for 
States on how to develop contingency plans. We know that States and Congress share our goal 
of protecting all our beneficiaries throughout the millennium transition. 

Budgetary Needs 

The Year 2000 problem is not static. We are obligated to perform rigorous testing because of the 
extent of our reliance on information systems. Efforts to solve one element of the problem often 
uncover other problems. This makes it challenging to determine our budgetary requirements. .4s 
you know, we previously have had to request additional funding and redirect existing funding to 
meet these changing demands. 

In fiscal year 1998, we received $107. 1 million in funding for millennium activities. This funding 
included a $15 million appropriation; an additional $30 million that was transferred from other 
agency projects; $20 million in redesignated funds originally appropriated for systems transitions; 
and $42. 1 million made available by the Department of Health and Human Services (HHS) 
through the Secretary’s one percent transfer authority. Through very careful financial 
management and a keen recognition of the importance of the Year 2000 effort, we actually 
obligated approximately $148 million in fiscal year 1998 on Year 2000 activities: $130 million on 
external systems and $18 million on internal systems. 

Thanks to your support in the fiscal year 1999 appropriations process we are making significant 
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progress toward obtaining the funding needed to support all of our Year 2000 efforts. We 
received S82.5 million in our appropriation for this year. The Office of Management and Budget 
(0MB), with Congressional concurrence, transferred an additional $205.1 million from the Year 
2000 emergency fUnd. This funding provides a total of $287.6 million to support our Year 2000 
efforts in fiscal year 1999. We plan to use FY 1999, as well as FY 2000, funding to increase our 
contingency planning efforts by developing, testing, and rehearsing contingency plans. 

The President’s Budget request for FY 2000 includes an additional $150 million for our Year 
2000 effort. In addition to funding our contingency planning efforts, a large portion of this 
funding will support outreach, continuing external systems remediation, and increases in billing 
and communications activities at our contractors. Increased public awareness of the Year 2000 
and concern about potential problems, coupled with possible disruptions in claims processing, 
may increase the number and cost of paper and duplicate claims, the level of inquiries from 
beneficiaries and providers, as well as related printing and postage costs. This funding will help 
us and our contractors meet these anticipated challenges. 

It is important to note that because our systems are highly automated and the majority of our 
processes are completed electronically, we are performing far more rigorous Year 2000 testing 
than many businesses. Many businesses are not testing their systems for future dates and they will 
not know with certainty if their systems will operate in the Year 2000. HCFA will. Our testing 
regimen is far more rigorous than the industry standard, with multiple layers of testing, including 
regression testing, testing in a simulated Year 2000 environment, and testing our entire systems in 


14 



72 


an actual Year 2000 environment. 

In addition to the extensive tests performed by those who actually maintain the system, we also 
are requiring independent testing of our most critical systems and additional oversight by an 
IV&V contractor. This coming year we expect to perform extensive validation and recertification 
of these critical systems to ensure that changes made during 1999 do not affect our Year 2000 
renovations. Although this additional testing and validation significantly increases the time 
required for, and the cost of, certifying the Medicare systems, we know that we simply cannot 
afford to fail and are doing everything within our power to ensure that we do not. 

Our systems are not only complex in their own right, they also require extensive data exchanges 
with more than one million partners, such as providers, banks, and vendors. We must guarantee 
that all of our renovated systems work with all of these partners And so we must conduct data 
exchange tests with the provider community to ensure that we can exchange the transactions 
required for electronic commerce. 

Conclusion 

We have made remarkable progress in our Year 2000 compliance effort and have taken critical 
steps to ensure that all of our systems will be ready for the new millennium. There is still a great 
deal of work to be done, but we now feel that we are making adequate progress. We will 
continue in 1999 to work, test and retest our systems. But I must reiterate our concern with the 
progress of some States and providers in meeting their own Year 2000 challenges. We are 
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committed to providing al! the assistance we can, but in some cases that may not be enough. We 
all share a common goal of guaranteeing that our systems and programs function in the new 
millennium. I thank you for your attention to this essential issue, and I am happy to answer any 
questions you may have. 
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Mr. Horn. I will turn to Mr. Callahan. 

Mr. Callahan. Thank you, Chairman Horn, Congressman Turn- 
er, and other distinguished members of the subcommittee. 

I am pleased to appear before you today to testify about the De- 
partment’s efforts to make its payment management system Y2K 
compliant. I am also accompanied today by Dr. Neil Stillman, who 
is the Deputy CIO of the Department, and Jeanette Clay, who is 
the Chief Information Officer for the Program Support Center. 

I would like to echo Nancy- Ann DeParle’s statement about the 
committee. Clearly sometimes even though these sessions may ap- 
pear to be a bit painful, clearly when we reach January 1, 2000 
and we succeed, in no small measure a good deal of the credit will 
go to you personally and to the members of your committee for ask- 
ing us to be as diligent as we can be on the Y2K effort. 

The payment management system, which is the subject of the 
hearing today, is run by the Program Support Center of the De- 
partment, not by HCFA; it is run by the Program Support Center. 
This serves 20,000 grantees across the Nation and it is a histori- 
cally sound and successful grants payment system. Indeed, in its 
more than 30 years of operation, it has only been down for one-half 
day during the blizzard of 1996. 

I will say this, since not many people know about the payment 
management system. It serves 20,000 grantees. It makes 260,000 
payments a year or about 1,000 payments a day. $165 billion a 
year goes through that system, and what happens in this system 
is States, for example, with regard to their grants which go 
through the system, draw down grants daily and most of the other 
grantees draw down their grant allocations every 2 weeks. In es- 
sence, it is a just in time grant payment system. This system, as 
it currently operates, saves the Federal Government $60 million a 
year as a result of adhering to the Cash Management Improvement 
Act. 

But as with any businesslike process, the Department of Health 
and Human Services is committed to making continuous improve- 
ments in the payment management system. That is why we en- 
gaged beginning in 1994 in the process of developing as a business 
solution the fourth major system development of this system since 
its inception in 1969. Yet in this particular case of reengineering, 
obviously we have to be fully cognizant of the need to make a new 
payments management system Y2K compliant. 

Therefore, in November 1998 we followed a parallel track of re- 
mediating the older legacy code, the current payment management 
system, to be year 2000 compliant as a contingency while at the 
same time continuing on a business solution to develop a fourth 
generation rebuild of the payment management system. 

Obviously given the decision at that time to look into following 
a dual track, we obtained the expert advice of the Avistar Corp. to 
assess the risk of completing the new system development, the 
fourth system rebuild of testing, the testing and implementation of 
the current system, the remediation of the legacy code with an eye 
toward achieving a low risk Y2K compliant payment management 
product in the shortest possible time. The report has been delivered 
to us by the Avistar Corp. this week. We will provide this to the 
committee in its entirety. 
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Based on that recent report that we have received from the 
Avistar Corp., we plan to proceed immediately with the testing and 
implementation of the renovated legacy based payment manage- 
ment system. We expect this system to be Y2K compliant; that is, 
renovated, remediated, tested and implemented by June 1999. 

At the same time, and this again comes from the recommenda- 
tion of the Avistar report, outside of this development effort, and 
not to complicate this decision, we will devote additional staff and 
resources to achieve the goal of having in place hopefully before the 
end of the calendar year a fourth generation Y2K reengineered 
PMS system. But I will emphasize to the committee we will not fol- 
low that second track and in any way that would jeopardize getting 
at the fastest possible date a Y2K compliant payment management 
system. 

We would hope to achieve obviously the best possible outcome of 
having two Y2K compliant payment management systems that 
could be available for operation in the year 2000 and at some point 
when we have a fully operational Y2K reengineered payment man- 
agement system, we will operate that in place of the current sys- 
tem. 

With regard to contingency planning, the Program Support Cen- 
ter, as is the case with all of our agencies, including HCFA, have 
supplied — at least I think most of them are up to their second 
drafts of their business continuity in their contingency plans, and 
we will be testing and implementing those contingency plans 
throughout the year. We believe that the contingency plan that is 
put forward to us is imminently practicable on the part of the Pro- 
gram Support Center and that the plans will ensure that the 
20,000 grantees that we now service across the government, includ- 
ing HHS, will receive the Federal funds that they are due for their 
prior year and fiscal year 2000 appropriations. 

We pledge to you on behalf of the Secretary, the Deputy Sec- 
retary and myself and the Program Support Center that our cus- 
tomers, our grant customers, will be paid in full and on time. You 
have our word on that. 

Thank you, and I would be happy to answer any questions that 
you may wish to pose to me. 

[The prepared statement of Mr. Callahan follows:] 
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INTRODUCTION 

Good morning. I am John Callahan, Assistant Secretary of the Department of Health and 
Human Services for Management and Budget (ASMB) and Chief Information Officer 
(CIO). I am pleased to appear before this Subcommittee to provide you with a report on 
the accomplishments and the challenges faced by the Department of Health and Human 
Services (HHS) in assuring that our systems are Milleimium compliant I offer my 
comments on behalf of the Department and the Program Support Center (PSC). 

The Secretary, the Deputy Secretary, and 1 have declared the Year 2000 date issue to be 
our highest information technology priority. We have taken and will continue to take 
strong actions to ensure that HHS information systems are Year 2000 compliant 

We have involved all parts of our organization, including staff vrith expertise in 
information systems, budget, human resources, and acquisition management in solving 
the Year 2000 problem. No matter what else we do and what other initiatives we 
undertake, we must ensure that our ability to accomplish the Department’s missitm is not 
impaired by the Y2K problem. 

For this reason, we established December 31, 1998 as our internal deadline for Year 2000 
compliance of mission critical systems intentionally setting it 3 months ahead of the 
official government-wide deadline of Match 31, 1999. This was done in order to provide 
a foil year of r^rerations in which to detect and remedy any adverse interactions mnong 
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HHS systems and those of our many service partners, including other Federal agencies, 
states and local governments, tribes, and contractors. As of January 3 1 , 1999, most of our 
mission critical systems were Y21C compliant 

HHS's YEAR 2000 EFFORT 

To meet our Year 2000 responsibilities, we have taken a series of strong administrative 
actions. We have encouraged aggressive reallocation of funds, where necessary, to meet 
Year 2000 deadlines; we have established direct reporting lines between staff working on 
year 2000 activities and the Operating Division (OPDIV) Chief Information OfBcers. 
Each OPDIV CIO is responsible for regular reporting on Year 2000 efforts directly to the 
OPDIV head and the Department’s Chief Information Officer until Year 2000 date 
compliance is achieved. 

HHS has also taken action to retain, re-employ, and attract qualified information 
technology professionals, using both employment and contracting authorities. On 
March 31, 1998, HHS received Department-wide personnel authorities ftom the Office of 
Personnel Management (0PM) to waive the pay and retirement reduction for 
re-employed military and civilian retirees who return to work on Y2K remediation. To 
date, the Health Care Financing Administration has used the waiver authority to reemploy 
forty-one annuitants and the Program Support Center has hired one annuitant. 
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HHS agencies collect a tremendous amount of information that requires data exchanges. 
The Department has inventoried our data exchanges and contacted our service partners to 
emphasize the importance of assuring Year 2000 compliance. HHS is working with the 
National Association of State Information Resource Executives (NASIRE) and others to 
assure a coordinated response. On April 22, 1 998, HHS provided a listing of State 
interfaces to NASIRE for its review of completeness and accuracy, and we will i^xlate 
this listing monthly until idl of our State interfaces are compliant HHS continues to 
update the listing on the GSA web site for NASIRE review. In addition to data 
exchanges with States, HHS systems also exchange data with other federal agencies, local 
governments. Medicare contractors and fiscal intermediaries, private insurance 
companies, universities, banks, and drug manufacturers. 

In addition, HHS is requiring all of its operating divisions to conduct thorough testing 
and independent verification and validation of its renovated systems. We also know there 
is a possibility that, try as we might, some systems may not be fiilly compliant in time. 
Consequently, all of our Operating Divisions have submitted initial business continuity 
and contingency plans to the Department. These plans will be finalized and tested 
throughout 1999 to provide us with the operation;! policies needed to permit business 
continuity in the event of system failure. 
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THE PAYMENT MANAGEMENT SYSTEM BACKGROUND 


The Division of Payment Management (DPM), of the Program Support Center (PSC), 
operates the Payment Management System (PMS) which provides centralized electronic 
funding and cash management service to all organizations receiving HHS grants. Besides 
making automated payments, DPM monitors funds in the hands of recipients, provides 
debt management services such as debt collection and serves as a customer service 
intermediary between grant recipients and grant awarding agencies. 

The Payment Management System (PMS) is a historically sound and successful system 
that provides grant payment services which include the expeditious flow of cash and 
corresponding disbursement data between awarding agencies and grant recipients. HHS 
has over 30 years experience in paying grants on a centralized/consolidated basis and in 
developing and maintaining systems to support this function. In the 1960s NIH 
centralized its payments for all of its grant. In 1975 the operation was trartsferred to the 
Office of the Secretary and began paying grants for all the components of HHS, and in 
the 1989 HHS began paying grants for other Federal agencies. This operation has proven 
extremely reliable, efficient and cost effective, realizing significant savings due to 
economies of scale. Indeed, it was down only one half day in recent history due to a 
blizzard during 1996. 
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HHS is now a recognized leader in the providing funds to recipients of federal grants on a 
just-in-time basis. The PMS supports organizations funded by ten other federal agencies 
and 42 different subagencies. In FY 1998 the system made 260,000 payments totaling 
$165 billion to 20,000 grantees. The PMS can receive automated or manual payment 
requests, edit them for accuracy and content, batch them for forwarding to the Federal 
Reserve Bank for payment, and record the transaction to the appropriate general ledger 
accounts. 

The current Payment Management System was implemented in 1984. Major 
enhancements have been implemented, such as providing the capability for grantees to 
request funds and obtain information about their account balances electronically via their 
PC, and allowing the grantees to report expenditures elecu-onically, thereby reducing the 
administrative burden on the grantees. Being committed to good business practices and 
to improving and reengineering our systems to provide better customer service, in 1994 
we initiated a business review of the PMS Legacy system resulting in a recommendation 
for a major reengineeiing effort to modernize the PMS. This system development effort, 
the fourth major PMS redesign in 30 years, was identified as mission critical for Y2K 
compliance purposes. 

The actual programming of the re-engineered PMS began in January of 1998, with a 
planned operational date of December 1998. As work progressed, DPM management 
became concerned about potential slippage in the schedule. Therefore, in order to ensure 
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Y2K compliance, we began to remediate Ae Legacy system code of the existing PMS. 
We, therefore, proceeded on a paialle! track, remediating the legacy code while 
continuing to develop the new PMS. 

Y2K ASSESSMENT OF THE PAYMENT MANAGEMENT SYSTEM 

My ofBee in conjunction with PSC initiated expedited Y2K compliance assessment 
activity to review PMS alternatives against the government-wide March 3 i Y2K 
compliance deadlines imposed by 0MB. To accomplish this, we sought expert outside 
advice to assess the risk and schedule for completing development of the new PMS 
versus testing and implementing the legacy remediated code. 

The PMS is undergoing a major re-engineering; major development deliveries have been 
completed; and testing and Y2K certification activities are still pending. The Re- 
engineered PMS introduces additional functionality not available with the Legacy PMS, 
in particular a Web-based interface and improved tracking and reporting features. The 
Legacy PMS has been Y2K renovated, but has not yet been validated or IV&V certified. 

Currently, based on the findings of an independent study neither the Legacy nor the Re- 
engineered PMS can be certified as Y2K compliant by March 31, 1999. Our lowest risk 
alternative is recommended as priority testing and implementation of the remediated 
Legacy system. Our secondary initiative will be to continue development of the new 


6 



83 


generation PMS with the goal of its implementation prior to January 1, 2000. This 
strategy is now being implemented by the PSC. This decision has the full backing of the 
PSC leadership, me. Deputy Secretary Kevin Thurm, and Secretary Donna Shalala. 

We will report back to the Committee monthly on the status of our PMS Y2K testing and 
IV&V certification efforts. It is our expectation that we will have the Legacy system 
validated and implemented by June 1999. We would further hope to have a compliant 
version of the newly developed PMS prior to year’s end. 

This Department believes we have thoroughly analyzed and evaluated the options for 
Y2K compliance of PMS, and we have chosen the lowest risk alternative, a remediated 
Legacy system that will yield rapid PMS Y2K compliance. 


BUSINESS CONTINUITY AND CONTINGENCY AJiD DAY 1 PLANNING 

The PSC has also developed a business continuity and contingency plan for the critical 
processes of PMS. This plan documents action items required should there be a Y2K 
problem and provides for testing of the contingency actions. This document will be 
shared with our federal customers. We have been using the PSC quarterly technical 
bulletin (Quickdraw) to keep our 20,000 recipients informed on Y2K issues and are fully 
prepared to make payments to our recipients on time when the year 2000 arrives. 
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Although we are confident that our efforts to ensure that PMS is Y2K compliant and that 
transactions across the end-to-end business process will be successfuiiy executed at the 
century roll-over, we have also developed plans to ensure business continuity in the event 
of an unforeseen system failure. The end-to-end process includes a number of criticd 
resources in addition to the Payment Management System. The other key components 
include: the systems at die grant-awarding agencies which transmit data on new awards 
or modifications to awards that are the input to PMS; the NIH/CIT Ifeta Center on which 
the PMS software runs; and the Federal Reserve systems that provide for payments into 
the commercial banking systems. 

The Business Continuity Plan developed by the PSC’s Financial Management Service 
(PSC/FMS) provides for a back-up process in the event of a failure in any of these critical 
resources. Should the granting agencies’ input systems be affected, or if the agencies are 
unable to transmit electronically, PSC/FMS will receive data on paper forms received via 
fax (if operational) or mail or courier service. Normal in-transit authoriation procedures 
would then be followed. Grant recipients may also request payments using phone, fax, or 
courier. Data will be maintained by PSC/FMS on a backup system using stand-alone 
compliant PC’s. Should a laoblera occur with the Data Center, an alternative back-up 
processing site would be available through the contingency plan for NIH/CIT. If a 
problem occurs in the transmission of transactions to the Federal Reserve, PSC/FMS will 
take advantage of redundancy in the processing path for PMS transactions. Alternative 
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Federal Reserve processing locations have been established, and the contingency 
procedures as established by those organizations will be followed to ensure that 
transactions can be completed. Finally, in the event that a Y2K problem prevents 
PSC/FMS staff to gain access to their workplace to conduct business, plans and 
procedures have been developed for staff to be able to continue to work from home or 
from an alternate site. 

In preparation for operation at the century roll-over, PSOFMS, as part of an overall 
HHS-wide effort, is also developing a Day One strategy. The organization will have key 
process and systems staff on site on the week preceding and following January 1 to 
ensure systems and processes are functioning properly, and to expedite the 
implementation of any needed business continuity measures or system contingency plans. 

CONCLUSION 


HHS still faces substantial challenges in its Year 2000 efforts. However, let me assure 
you, on behalf of Secretary Shalala and Deputy Secretary Kevin Thurm, that we will 
continue to vigorously pursue Year 2000 remediation as our most important initiative. 

The Department of Health and Human Services intends to meet its responsibility to insure 
that our Payment Management System which now serves some 20,000 grantees in a 
number of Federal agencies is Year 2000 compliant. There will be no cash flow 
problems for our customers due to Y2K problems. Our customers will be paid in full and 
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on time. 

We recognize our obligation to the American people to assure that HHS s programs 
Ihnction properly now and in the next millennium. 

I thank the Committee for its interest and oversight on this issue, and I would be happy to 
answer any questions you may have. 
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Mr. Horn. Thank you. We are going to ask Mr. Willemssen to 
rejoin the panel. And we will begin the questioning, and the Gen- 
eral Accounting Office is free to comment on all the questions and 
answers as we go through this. We appreciate the testimony both 
of you have given. It clears up some of the matters. 

Let me start the questioning, if I might, and yield myself 5 min- 
utes of time here. First, I would like to ask the Administrator, in 
your testimony you state that 17 of the 54 compliant systems are 
highly compliant and the other 34 require a moderate level of effort 
to resolve any remaining issues. Is that correct? 

Ms. DeParle. Yes, sir, that’s based on our IV&V contractor’s as- 
sessment. And then yesterday our staff on the government manage- 
ment group personally met with your staff. 

Mr. Horn. Now, your staff stated yesterday that all 54 compliant 
systems required only minimal effort to complete the remaining 
issues. And I guess the question is, what’s the definition of compli- 
ant? How do we know when we are complete here? What kind of 
testing has gone on? 

Ms. DeParle. Well, what we mean when we talk about compli- 
ance is that all mission critical — I guess it has four steps, all mis- 
sion critical, local source code, software and hardware used to sup- 
port the system were renovated and Y2K compliant. Second, that 
the individual contractor had completed unit testing, integrated 
testing, system testing and end-to-end testing on the front ends 
and the shared system software interfaces. 

Third, that the entire system had been future date tested using 
a combination of future dates simulation and in a separate future 
date tested environment. That’s the so-called hard IPL. And they 
have to have completed and reviewed output from claims cycles 
during hard IPLs for at least two future dates for the recertifi- 
cation in July. We are going to require them to test more future 
dates, but for this initial certification it was just two. 

In fact, Mr. Chairman, there were a couple who turned in certifi- 
cations to us, and when we checked on-site they hadn’t done those 
tests, so we took them out. 

And, finally, they have to ensure that all mission critical busi- 
ness functions would be Y2K compliant by verifying and, where ap- 
propriate, testing the readiness of all mission critical hardware, 
software, commercial off-the-shelf software facilities and vendors 
used to support such functions. 

And that last area is one area I would like to just point to, be- 
cause one of the differences between us and GAO is that there are 
some contractors who had some COTS software, commercial off- 
the-shelf software, that was not tested and was not Y2K compliant. 
But in their qualifications to me, which I held up a while ago what 
we had sent to the committee, the contractor identified that. And 
we checked it to see whether or not it was mission critical; and if 
it wasn’t we went ahead and accepted their certification. 

Now, by this July, when all of that other testing is done, every- 
thing is going to have to work, no ifs, ands or huts. But we felt that 
was a minor qualification at this point. And I think — Mr. 
Willemssen and I have discussed this, and I think from the GAO’s 
perspective, they think all that should have been done in Decem- 
ber. So I think that’s the issue. 
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Mr. Horn. Well, on that very point, you’ve given a definition of 
compliant and the Office of Management and Budget on behalf of 
the President also has a definition, and the General Accounting Of- 
fice has a definition. And I guess I would ask, Mr. Willemssen, as 
you listen to this discussion, are they compliant in terms of 0MB 
standards and GAO standards? 

Mr. Willemssen. Well, what HHS has put in their report, the 
quarterly report to 0MB, is that they would provide a description 
of the progress on their systems being consistent with the CIO 
counsel’s best practices ^ide and GAO’s assessment guide. So from 
a criteria perspective, given that statement, we used our guide as 
a measure of whether those systems were compliant. 

The Administrator is correct, much of that computer date testing 
was done. Having it done and then resolving the problems result- 
ing from that testing are two different matters. We expect the reso- 
lution of problems emanating from testing to also be done prior to 
deeming a system compliant. In many cases that has not yet been 
done. 

And I will again repeat, if these issues were considered minor as 
of December 31st, then one would expect 2 months later, February 
26th, that those issues would have been resolved. We haven’t seen 
evidence that they have been resolved and tested so that those sys- 
tems can be deemed compliant at this point in time. 

Mr. Horn. Well, let me ask the Administrator. Are you aware of 
the lag there, despite the fact that those look like minor bits of the 
glitch and not major? 

Ms. DeParle. Yes, sir, I am. And in fact, Mr. Willemssen and 
his colleagues spent a couple of hours with us on Monday going 
through all of this to make sure we understood it, and on those 
specific examples that he cites, I don’t know if it’s in this testi- 
mony, but it’s one that he discussed. The Florida shared system, 
which is one of our biggest systems, there were a couple of issues 
in their report that in fact they have corrected — they corrected as 
of January 29th. Those were qualifications that they identified to 
us and then they corrected and we do have evidence of that. So, 
I asked Dr. Christoph about this yesterday, just to be sure, and he 
advises me that these things have been corrected. 

Mr. Horn. Thank you. Since we have a visiting Subcommittee on 
Technology, I’m going to yield to the chair of that subcommittee, 
and then to Mr. Turner on our committee and then to Mr. Gordon 
on that committee. So the gentlewoman from Maryland, who is 
chairman of the Subcommittee on Technology. 

Mrs. Morella. Thank you. Thank you, Mr. Chairman. The ques- 
tion I want to ask has to do with personnel, since so much of Y2K 
compliance relies on people. I mean it’s so intensive in terms of 
labor. And since there are really so few who may know COBOL and 
may know that system, et cetera, could you give me a candid anal- 
ysis of how personnel fits into the compliance strategy? And I’m 
asking you, do you have trouble with recruiting people? 

Have you had to rely more than you’ve ever thought on contrac- 
tors and subcontractors because of that? Are you losing some peo- 
ple who may have seniority or expertise? I know this is a tough 
question with many implications, but I would really like your can- 
did assessment of it. 
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Mr. Callahan. Congresswoman Morelia, let me make a brief 
comment and defer to HCFA Administrator DeParle. You’re abso- 
lutely correct that the human resource dimension is the critical ele- 
ment of getting this Y2K compliant problem solved. It is a difficult 
problem. Certainly the people that are working on it in the agen- 
cies, whether that be at HCFA or Program Support Center, support 
and deserve our commendation for the long hours that they are 
putting in and the efforts they are making. 

The Department of Health and Human Services was the first 
agency to go to the Office of Personnel Management and ask for an 
amendment to the law to rehire annuitants that were familiar with 
the Y2K problem that had worked at these agencies and could 
come back and help us in this effort without losing their annuity. 
As you know, given your experience, if you rehire they — we’ve hired 
approximately 54 reemployed annuitants. HCFA has taken the 
lead. I think they have over 50 of those, and the Program Support 
Center has brought back a person. 

So we took the initiative as a department to go out and seek 
those qualified employees to come back and help us, and they have. 

Ms. DeParle. I would say, though, just to add a little bit to this, 
from speaking to our contractors around the country, the 60 con- 
tractors who operate these 78 systems that we’ve been talking 
about this morning, they have had difficulty as well in hiring and 
retaining the kind of personnel that is needed. 

And it is something that I think as we get closer and closer to 
the deadline, one of the concerns I have when we talk about what 
the challenges are out there, not even just for our contractors, be- 
cause they’ve known about this for a year, and they’ve been work- 
ing, but for some of the providers like the ones Congressman Turn- 
er talked about, if they haven’t already started, they’re going to 
have trouble finding people who can do this work. And that’s some- 
thing I’ve been concerned about. 

Mrs. Morella. Have you been losing people because of the lure 
of higher salaries in the private sector? 

Ms. DeParle. Hardly a week goes by that I don’t have one of my 
senior people in the information services area approached, and I 
suspect Mr. Willemssen has the same experience, because they do 
have such valuable expertise. We have been lucky in that our folks 
feel very committed to this project and seeing it through and are 
patriotic about it, I think. 

Mrs. Morella. Has any of the work been sent offshore? 

Ms. DeParle. Well, HCFA has a long history of public/private 
partnerships from the inception of the Medicare program. For 34 
years, we have worked through contractors. There are only 4,000 
people working in Baltimore, there are 25,000 people working at 
these contractors. So we’ve always had an imbalance, if you will, 
with most of our work in this area really being done offsite. 

So, we were already using contractors, and I think as Mr. 
Willemssen pointed out, there’s a sense, on this particular project, 
that contractors are helpful, because they can come in and look 
over your shoulder, and that’s what the IV&V contractor, that GAO 
advised us to get, has been doing. 

Mrs. Morella. Is there anything we can do to help with regard 
to contractors? 
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Ms. DeParle. Yes. 

Mrs. Morella. I would imagine the data exchange law that 
passed would have been of some assistance in terms of freeing up 
some of the chilling effect of just sharing information? 

Ms. DeParle. I think it helped. And as I mentioned before, one 
of the first things I did was ask contractors to sign an amendment 
to their contract requiring them to be compliant. And I was 
rebuffed pretty strongly for about 6 months. And then after Con- 
gress passed the law, they became more willing to do it. Because 
one of their concerns had been what if the power systems fail or 
what if things beyond our control failed, and you helped with that. 

I should note, too. Congresswoman, you asked me about work off- 
shore, and we don’t have anyone working offshore. 

Mrs. Morella. No, the contractors may and do, whatever, but 
you don’t. 

Mr. Willemssen, would you like to comment on that whole con- 
cept of personnel? 

Mr. Willemssen. A couple points I will make. First is to echo 
what Dr. Callahan said is one of the best things that the executive 
branch did was 0PM allowing retired retirees to come back without 
a reduction in their annuity. That’s something we have supported 
for some time. That was an excellent move. Many agencies, includ- 
ing HHS, have taken advantage of that. Second, in a report we did 
last year in the personnel area, we did see quite a bit of anecdotal 
evidence throughout the government that, indeed, there were peo- 
ple leaving for higher salaries. 

There wasn’t any systemic analysis done, but clearly it was an 
issue that was coming up. Third, as we move into 1999 the issue 
will become less about finding people who can fix the code, so to 
speak, and more about people who have an excellent understanding 
of end-to-end testing and contingency planning, and I think those 
kinds of resources will increasingly be in short supply. 

Mrs. Morella. I want to thank you all and thank you for work- 
ing together. I think this is critically important, and I hope that 
you will continue to see us as an important part of working to- 
gether with you. Thank you. 

Thank you, Mr. Chairman. 

Mr. Horn. I thank the gentlewoman, and I now yield to the 
ranking member on the Government Management, Information, 
and Technology Subcommittee, Mr. Turner of Texas. 

Mr. Turner. Thank you, Mr. Chairman. Administrator DeParle, 
I want to ask you first to kind of go back with me a little bit. I 
know that much of the work that you’ve done trying to become Y2K 
compliant has been very, very costly. 

From your perspective, has the agency been provided sufficient 
funds to put you in the position to be Y2K compliant? 

Ms. DeParle. Yes, sir. And I want to thank the members of the 
committee who have supported us and the Secretary, last year 
when we realized after getting the IV&V contractor that we had 50 
million lines of code to renovate, instead of what they originally 
thought, which was 20 million. We needed some money fast. And 
the Secretary did something that was very difficult. She basically 
tapped funding from other agencies in the Department to come up 
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with $40 million, so that we could have right then and go ahead 
and get the contractors to hire people to do this work. 

It would have heen harder if we had had to wait for the emer- 
gency supplemental to get that done. And so there’s been complete 
support for this throughout the administration and from the Con- 
gress. 

Mr. Turner. Inasmuch as you’ve had sufficient funds to pursue 
Y2K compliance, what are the reasons then for the delay in the im- 
plementation of the Balanced Budget Act? 

Ms. DeParle. Well, it’s a matter of the complexity of some of the 
changes that were made in the Balanced Budget Act. We’ve imple- 
mented, I think, almost 200 of the more than 300 provisions that 
were in the Balanced Budget Act. But there are a few provisions 
that are extremely complicated, like developing new payment 
methodologies for home health agencies and for rehabilitation hos- 
pitals and for outpatient departments of hospitals. Our IV&V con- 
tractor, AverStar, came to me last April or May, I think it was, and 
made the strong recommendation that we stop that work, that we 
not proceed with trying to make those changes, because it’s one 
thing to make them on paper, in the law, up here and for us to 
write the regulation and the policy. 

But when you have to start implementing those changes into the 
software — and you had these contractors who were trying to ren- 
ovate and test the 50 million lines of code at the same time that 
they’re trying to implement complicated software changes — our 
IV&V contractor told me in no uncertain terms that that would not 
be a prudent thing to do. So we had to stop that work. We’re going 
to resume it as soon as it is feasible after January 1, 2000. And 
I hope we will be close to being on track. But I felt I had no choice, 
because this had to be the No. 1 priority. 

Mr. Turner. Well, as you know, there’s been quite a few hard- 
ships created, particularly in the home health area in recent 
months, and it seems to me that what you’re telling us is that it 
was your concern about the ability of some of the contractors to 
perform both tasks; that is, to be able to implement the new re- 
quirements of the Balanced Budget Act and to be Y2K compliant, 
that caused you to make that decision. 

Ms. DeParle. That’s right. And at the point in time that we 
were — and I think you’ve heard from our colleagues at the GAO 
about the — from the chairman himself. There’s nothing that can 
change this deadline of January 1, 2000. And even with more 
money, we couldn’t necessarily be sure that we were going to get 
the work done at the level and the quality that it needed to be 
done. So, I was faced with a choice of do I want to be sure that 
we’re paying claims January 1, 2000, or do I want to get these 
extra things done. 

And that was a hard choice. But as I said, I felt I had no choice. 
I had to be sure we were going to have our systems ready. 

Mr. Turner. Did the law itself impose deadlines upon you that 
you, in effect, did not comply with or was this within the discretion 
of the agency? 

Ms. DeParle. The law itself imposed deadlines in two or three 
areas. In the home health area, the Congress, once we had in- 
formed the authorizing committees, last summer made some 
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changes in the home health interim payment system to try to cor- 
rect some of the problems that had occurred from that and also ex- 
tended the deadline. The original deadline was October 1, 1999 to 
implement this new prospective payment system. 

And, in fact, before we even started on it, as you may recall, 
there was some doubt about whether it could be implemented so 
quickly and the Congress included in the law an automatic 15 per- 
cent reduction for the home health agencies in the event that we 
did not implement. And so last summer, what the Congress did, 
was decide to change that. And they extended for another year the 
implementation. It’s now October 1, 2000, and we’re on track to 
meet that. 

Mr. Turner. I might ask, Mr. Willemssen, if you had any over- 
sight over that particular decision, and did you concur with the de- 
cision that was made? 

Mr. Willemssen. I would want to emphasize one point that the 
Administrator made, any time that additional changes are made to 
the software, if indeed that system has been deemed compliant, 
HCFA and the contractor will have to go back in and retest and 
recertify that the changes that were made have not changed the 
system in such a way that it was now not year 2000 compliant. So 
that adds an incredible extra amount of effort beyond what would 
otherwise have to be done. 

Mr. Turner. My time is about to expire. Thank you, Mr. Chair- 
man. 

Mr. Horn. The gentleman from Tennessee, Mr. Gordon. 

Mr. Gordon. Thank you, Mr. Chairman. One of the common de- 
nominators that I see between Federal agencies and the private 
sector in the Y2K problem is no matter how well the agency or a 
corporation might get their act together, they’re still somewhat hos- 
tage to vendors and providers. So I guess. Administrator DeParle, 
no matter how good a job that you might do with your agency, you 
know, how much at risk are you with these vendors and providers, 
and what can be done, and where does that stand? 

Ms. DeParle. Well, with vendors that we deal with in Baltimore, 
we will make sure that they’re either Y2K compliant or that we 
have a contingency plan in place to get around them. But the area 
that I’m most concerned about now, as we begin to see daylight on 
finishing our work and getting that done with the contractors, is 
what about all of these providers. 

And as I said, we took the unprecedented step of writing a letter 
directly to all of them. We do not usually do that. Normally, the 
contractors deal with the providers, because that’s where the 
claims come in. We do not deal with them directly. But we have 
been trying to be much more aggressive than we ordinarily would, 
because I’m worried some of them will wait until the last minute 
and try to make these changes and they will not be able to do it. 

Even if I’m sitting there and my contractors are ready to pay 
claims, they will not be able to generate a claim. I think, as I said 
earlier, the good news is that based on what we know so far, we 
set a deadline. We started telling them a year and a half ago that 
they had to be able to submit claims in an eight digit format so 
there would be four digits for the year, so those would be compli- 
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ant, and we have extended the deadline a couple times. The dead- 
line is now April of this year. 

And there’s been some complaining, but from what we’re seeing, 
the compliance is really jumping up. So I’m hoping that is a good 
sign that providers will be ready. But I continue to share Congress- 
man Turner’s concern that there are going to be providers out 
there whose awareness is not what it should be and that they’re 
not going to be ready. And from the standpoint of our beneficiaries 
that is what concerns me. 

Mr. Gordon. You know, any time you deal with a complex prob- 
lem, you have to have priorities. And I think that it’s wise as it — 
within this problem to establish, as has been, so-called critical or 
noncritical missions. And we mostly talked about the critical mis- 
sions. Tell me a little bit about the noncritical missions. You know, 
what are some of the things that may not get done because you can 
only do so much, and what impact are you going to have? 

Ms. DeParle. Well, for example, I mentioned that in December 
we finished renovating and testing all of our 25 mission-critical in- 
ternal systems, the ones that we operate in Baltimore. And those 
include systems like the one that makes Medicaid payments to the 
States and the one that makes managed care payments to man- 
aged care organizations for Medicare. It did not include some other 
systems that we are in the process of renovating now, and I believe 
we’re going to make the March deadline on those. But there are 
things like surveys that we do of beneficiaries and other sorts of 
software that we maintain to keep data on beneficiaries. 

Those things would be of a lower priority as we move toward 
what are our essential missions. And that’s sort of how we’ve done 
our contingency planning, focusing on what are our essential mis- 
sions. For example, what has to happen on day one to keep our 
business functioning. There will be things such as beneficiary edu- 
cation and things like that, that might not happen if we are in a 
contingency mode for some reason. 

Mr. Gordon. OK, thank you. 

Mr. Horn. Now, I yield 5 minutes to the vice chairman of the 
Subcommittee on Government Management, Information, and 
Technology, Mrs. Biggert of Illinois. 

Mrs. Biggert. Thank you, Mr. Chairman. Ms. DeParle, it seems 
like you’ve got an awful lot to accomplish here, and you have made 
this your top priority and are working very hard to accomplish it. 

Are you still able to do business as usual and really, you know, 
continue with what you are working on, such as Medicare, Med- 
icaid plus program and things like that? Do you have enough per- 
sonnel to continue on your regular scope of business? 

Ms. DeParle. Well, there’s no question that we’re stretched. And 
for example, on the ones that you raised and on the many other 
things that we’re doing, the other Medicaid tasks. Medicare, bene- 
ficiary education, we’re probably not doing as much on those as we 
would have been. It is not because those staff are working in infor- 
mation systems and making the renovations or overseeing that, but 
because we’ve had to deploy staff to go out to contractors and over- 
see their work. 

And we have a lot of staff working right now, I think maybe al- 
most 100 people of our 4,000 are working virtually full-time, on 
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contingency planning because we have to get that done by March. 
So I think it has probably slowed down progress in other areas. 

You heard the questions that Congressman Turner asked me 
about the Balanced Budget Act. When you make something your 
top priority, it means that you’re probably diverting attention from 
other things. I think we’re getting our essential missions accom- 
plished despite that. But there’s no question that Y2K has been 
something that we had to put our full focus on. And certainly in 
the information systems area, which is one of this committee’s in- 
terests, Dr. Christoph I brought from the Los Alamos National 
Laboratory to help us develop a new information technology infra- 
structure, which is something that we need. 

That isn’t what he’s been doing. He has spent his full time work- 
ing on managing this Y2K project, because this is what we had to 
get done. 

Mrs. Biggert. Thank you. Then you, in your testimony, talked 
about the States, as well as providers, but the State as the pro- 
vider, and said you don’t really have the authority to demand that 
they are compliant. But you’re working with them. Are there any — 
well, are you working with the States really to educate them on 
this as a top priority, and what else can be done to ensure then 
that the State systems will not fail? 

Ms. DeParle. Well, we are working with the States, and we 
started that well over a year ago by sending them the GAO’s guide- 
lines on what they should be doing. But last summer, I became 
concerned about where the States were, because we were getting 
self-reported data from them that didn’t give me confidence that 
they were all sufficiently on top of it. The GAO was also looking 
at it and was getting similar data that they reported to the Con- 
gress in November. 

So we ended up hiring an IV&V contractor to go out to the States 
to investigate how they were doing. There are two main systems 
that they operate that are critical to Medicaid. One is their eligi- 
bility system, and the other is their — what’s called their MMIS, 
their Medicaid Management Information System. And we have 
sent independent contractors out to — I think we’ve been to 16 
States now, and it will be 20 by the end of the month and by April 
we will have been to all 50 States — to just investigate how they’re 
doing. 

We’re working directly with them, sending them the results in 
the same way that GAO would send us the results, giving them an 
opportunity to comment, but we’re going to aggressively identify 
the problems there. We’re also asking to see their contingency 
plans. 

And by the way, we pay for this. You should know that Congress, 
through the Medicaid program will pay for States’ remediation ef- 
forts, 75 percent, as well as if they had wanted to hire IV&V con- 
tractors, you would have paid for that. And we urged them to do 
it. Most of them weren’t doing it, which is why we decided to do 
it ourselves. 

Mrs. Biggert. Are there other working groups, like say as 
groups of hospitals, are you getting together with them to discuss 
the problems? 
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Ms. DeParle. Yes. We’re meeting on a biweekly basis with all 
the different trade associations in town that deal with health, and 
I’ve met personally with the State Medicaid directors, with the hos- 
pitals, with the managed care plans. We’ve had hundreds of meet- 
ings with them about this. 

Mrs. Biggert. Is that a definite structure that’s set up and when 
did that start to occur? 

Ms. DeParle. It started, I want to say, in earnest in late spring 
or summer of last year — the outreach effort — and has been con- 
tinuing, as I said, on a biweekly basis since then. 

Mr. Callahan. I might add, if I could on that, John Koskinen, 
who is the President’s special advisor in year 2000, has asked all 
the various Federal agencies to share various sector groups. The 
health — the overall health and the human services sector group is 
shared by the Deputy Secretary in our department, Kevin Thurm, 
and as Nancy Ann has mentioned, we do have periodic meetings 
with the health care sector, not just hospitals, but, for example, at 
a recent meeting with the pharmaceutical association, the drug 
stores, the Veterans Administration, et cetera. So we’re actively 
reaching out to them to get their best information possible as to the 
Y2K situation. 

Mrs. Biggert. Just one last question. GAO talked about every 
time there’s a change or someone is not in compliance then it has 
to be retested and reworked. What time do you envision that you 
would be able to test every system and if it works, and if it doesn’t, 
will you still have enough time to rework it? Is that like October? 

Ms. DeParle. We plan to complete our end-to-end testing by the 
end of October. And in July, we’re going to freeze all of our sys- 
tems, in other words, not make any other changes that would re- 
quire another whole round of testing. But he’s exactly right, that’s 
been one of the complications of what we do, because so much of 
what we do involves making updates and changes and that kind 
of thing. And if you’re doing that, it interferes with the work you 
need to do to make sure everything is compliant. 

Mrs. Biggert. Thank you very much. Thank you, Mr. Chairman. 

Mr. Horn. Thank you. We will now start on round two of 5 min- 
utes apiece. I would like to just clarify what’s compliant and what 
isn’t. 

Mr. Secretary, as I look at what the whole department sub- 
mitted, they said there was a dramatic 34 percent increase this 
quarter. And I’m just curious, I think it was made up of 96 critical 
mission systems, as I recall, and then the question would be, is the 
Medicare 54 part of the 96? 

Mr. Callahan. Yes, I believe it is, sir. 

Mr. Horn. OK. Then the question gets down, Mr. Willemssen, do 
you think their view of compliance and the General Accounting Of- 
fice’s view of compliance, do you think we’re on the same wave- 
length or is there a discrepancy here? 

Mr. Willemssen. We definitely have a discrepancy on those 54 
systems. 

Mr. Horn. And what do you think has to be done to make them 
come into compliance? 

Mr. Willemssen. We not only have to go in and change the soft- 
ware to deal with the problems that have been identified, but you 
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also then have to test that those changes have fixed the problems 
that were previously identified. And that — we haven’t seen that 
evidence for those 54 yet. 

Mr. Horn. Any reaction of both the Administrator and the Sec- 
retary? 

Ms. DeParle. Well, I think part of what Mr. Willemssen is talk- 
ing about is, as auditors, the GAO relies on the paper trail, and 
they looked at the self certifications that we got at the end of De- 
cember, and they were looking at the paper trail. The qualifications 
that were given to us were worded quite broadly. They were writ- 
ten by lawyers. That shouldn’t surprise me, since I’m the one who 
started this by saying I wanted a contract amendment. But what 
I think the GAO wants to see is paper evidence again that they can 
rely on to say that those things have happened, and I think we 
should get the GAO that. 

Mr. Horn. Well, as you know, the basis for judgment both by the 
executive branch and the legislative branch is the fact that we deal 
with self-reported data, and that’s why we try to clarify when we 
get into one of these things as to the degree of progress a particular 
department is making, such as Health and Human Services. We 
want to figure out what’s backing those numbers, and is there an 
agreement on definitions so we’re all singing from the same hymn 
book and that we don’t have dissidents, we have harmony, and 
that’s why we’re fishing to see if, indeed, we really have had more 
systems comply in this last round that we’ve reported on last week. 
And I take it you agree that there’s still a lot of work to be done 
to make them really compliant? 

Ms. DeParle. Well, actually on a couple of systems that the 
GAO has expressed concerns about, and I mentioned the one in 
Florida. We believe we’ve given them the documentation that 
should have satisfied them. 

And just to follow your point, Mr. Chairman, I also don’t want 
to rely just on paper, because I learned very quickly that wasn’t 
good enough, and that’s why I asked a number of our employees 
to leave their home base to go to Little Rock, AR and Richmond, 
VA and places where they don’t live, to be onsite with these con- 
tractors to make sure what the contractors were telling us was 
what was happening. 

So we have more thorough information than anyone else does 
about this. But having said that, you know Mr. Willemssen has 
been very helpful to us, and I trust his assessment of this. And I 
want to make sure that — I don’t have any interest in relying on 
something that isn’t accurate. So I want to make sure that the 
GAO is satisfied. 

Mr. Horn. Well, may I suggest that both the General Accounting 
Office and your agency, HCFA, agree on a pattern of testing just 
to solve this problem and make sure everybody is talking the same 
language? 

I want to move on now, Mr. Callahan, to an area in which you 
are involved. Very few of the departments merged the Chief Infor- 
mation Officer role with the Assistant Secretary for Management. 
How did that happen in HHS? 

Mr. Callahan. Mr. Chairman, you and I have had some previous 
discussions on this. We are a very centralized — we have a very cen- 
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tralized management system at headquarters in HHS. For exam- 
ple, I am the Assistant Secretary of Management and Budget, 
Chief Information Officer. I’m also the Chief Financial Officer. 
There are days when I probably wish I could shed some of those 
responsibilities. 

Mr. Horn. But don’t you need somebody else to work 18 hours 
a day, 7 days a week? 

Mr. Callahan. Let me say this, I don’t do it all myself obviously, 
but we have able Deputies, Deputy CIO Dr. Stillman, et cetera. 
But the key point here is we are able to move very, very quickly 
on behalf of the Secretary and the Deputy Secretary to make those 
decisions, I think, which help the Y2K situation. For example, in 
the area that Administrator DeParle mentioned last year, HCFA 
indicated that they needed an additional $40 million on an urgent 
basis. Because I’m the Assistant Secretary of Management and 
Budget and work with the Secretary and execute the authority we 
have to transfer up to 1 percent of our appropriations among ac- 
counts, we were able to execute that and do it in record time so 
that in essence we met that deadline. I dare say that other depart- 
ments would not have been able to do it as quickly or as effectively 
as we did. So there are benefits in centralization. 

Mr. Horn. Well, there’s also when we could get two other fine 
people like you working on various aspects, both the financial and 
the information side, it seemed to me we would make a little more 
progress, because this is just a heavy job, you all know that. 

Mr. Callahan. Yes, sir. 

Mr. Horn. And Treasury did the same thing, and Treasury has 
got major problems I think because of that, where they didn’t have 
a new business and focus of energy in an area to straighten it up. 
I will get back to a few other questions later. But let me now yield 
to Mrs. Morelia, the gentlewoman from Maryland. 

Mrs. Morella. Thank you. You know, one of the concerns with 
regard to this computer glitch is how the public is going to react. 
I mean attitude, whether it’s going to be panic, whether it’s going 
to be a laissez-faire concept that we don’t have to worry about any- 
thing. I always say it’s between Chicken Little and Pollyanna, in 
terms of where we should be. But how are you communicating with 
the public to assuage concerns that people may have — and that I 
think will be exacerbated as we get closer to the date and you’re 
hearing more and more about Y2K. I mean Steve and I were in- 
volved in this 3 years ago as we started, but only now are people 
beginning to realize, you know, Mark Gordon and others, are begin- 
ning to realize that this is a situation where we can’t have a con- 
tinuing resolution. 

Do you have a responsibility to communicate, to establish infor- 
mation lines, again, to assuage concerns that your recipients, 
whether it’s agencies. States, individuals, are experiencing or will 
experience? 

Mr. Callahan. Congresswoman Morella, we absolutely have that 
responsibility, and we have that responsibility in the context, as 
you know, of working with John Koskinen under the President’s 
Y2K Conversion Council. He has made it clear that one part of his 
efforts in terms of advising the President and the general public is 
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to give periodic reports to the President and the general public 
about our Y2K readiness and our ability to meet the Y2K situation. 

As Administrator DeParle mentioned, she’s worked — she sent out 
nearly 1.25 million letters to the providers, hospitals, doctors, et 
cetera, who have to on their own, as you know, they have to work 
hard to meet their side of the Y2K question. We intend to obviously 
offer this committee and the public as much information as we can 
as to the situation with regard to Y2K readiness. So you’re abso- 
lutely right. We have that responsibility, and we will exercise that. 

Mrs. Morella. Would any of you like to comment on it? 

Ms. DeParle. Just one more comment. Another thing we’ve been 
doing more recently in this health care sector group that I men- 
tioned that’s working together with the various hospital, doctor and 
other groups, rural providers and others, on outreach is our first 
level of reaching out to the actual providers themselves, to make 
sure they’re ready, because that’s the best risk mitigation strategy 
you can have is to make sure they’re ready. 

But we do think the next step is to work together to reassure the 
public, and we think that’s something that we should do as an 
agency and as a department with the providers. So, for example, 
we’ve been working with the drug companies on how we will reas- 
sure the public on those issues and the Deputy Secretary of the de- 
partment is leading that effort. We’re working with the hospitals 
on how we will reassure the public about their readiness. So that’s 
sort of the next step of this. 

Mr. WiLLEMSSEN. If I may make two points, one general and one 
a little bit more specific. The general point is the best way to com- 
bat public panic is with hard data, and the Federal Government is 
obviously in the lead on that and has been for some time. Federal 
agencies can provide data on where they’re at, and they will have 
organizations such as GAO coming in and looking at where they’re 
at, and making assessments of that. So I think to the extent that 
we can put the data out there, that will help combat the fear. 

Second, and a little bit more specific to HCFA, a hearing like this 
obviously airs that HCFA has some issues and some challenges 
ahead and that there is a high possibility that there will be some 
system failures. But to the extent that HCFA can demonstrate 
through the remainder of this year that the excellent efforts it will 
have done in the contingency planning area, it can then say even 
if we do have some system failures, don’t worry, because we have 
some backup plans in place to make sure that providers are paid 
and services are still provided. 

Mrs. Morella. I see a role for public service announcements, 
maybe some other kind of simple mailer to people to just say we 
are working on it, we will be all right. We will have perhaps, at 
most, some inconveniences, but we want you to know that blah, 
blah, blah, because I’m hearing more and more from people, will 
my Social Security check be out there. We say, oh, yes, they started 
in 1989 and they’re doing very well and then you get into the other 
areas. 

They also want to know what should they ask, you know, par- 
ticularly in the medical field. I just think all of us, whether it’s 
done through agency by agency, I think there should be a strategy 
for communicating with the public. 
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Mr. Callahan. I do know, as I’m sure you’re aware, that the 
FTC, for example, has omnibus Y2K consumer Website where 

Mrs. Morella. Yes. 

Mr. Callahan [continuing]. If you as a consumer want to know 
about your microwave, or whatever it is you want to know about, 
you can get into that, and they will try to provide you the best an- 
swers as possible. As does SBA, for example, with small businesses. 

Mrs. Morella. They have their Website, I know. And the other 
day I was at an event for Red Cross. Red Cross has a wonderful 
little pamphlet for consumers, for constituents, what should you 
ask, what should you know, what is Y2K, done very simply, noth- 
ing complicated. But it gives a feeling that we know something 
about it and we will have a part to play and ultimately people are 
working on it, it will be OK. 

Thank you all very much. Thank you, Mr. Chairman. 

Mr. Horn. Thank you. Now I yield 5 minutes to questioning to 
the ranking member of the Government Management, Information, 
and Technology Subcommittee, Mr. Turner of Texas. 

Mr. Turner. Dr. Callahan, you mentioned that you’re having to 
operate both computer systems for the payment management sys- 
tems for the year 2000. The old system has been updated and you 
still got the new system you’re bringing on line. 

Mr. Callahan. I might correct that. Let me — I don’t want to in- 
terrupt, but that’s not quite precise, but I will 

Mr. Turner. Go ahead, if I misstated it. 

Mr. Callahan. Actually the reengineered payment management 
system, which is the one that we want to put in place of the exist- 
ing system, is not operational. This was brought about as a busi- 
ness decision starting in 1994. A basic decision was made that we 
should have a new payment management system, and we will pro- 
vide you a chronology of what’s happened with regard to that sys- 
tem. 

[The information referred to follows:] 



ANSWER: The chronology of the reengineered Payment Management System 
(PMS) is as follows: 


June 1993 
1994 

Sept. 1995 
July 1995 
April 1997 
Dec. 1997 

Jan. 199S 
Dec. 1998 
Jan. 1999 

Feb. 1999 
Feb. 1999 


CHRONOLOGY OF REENGINEF.RFn PMS 

Business Review - Logistics Management Institute (LMI) 

Business decision to reengineer PMS 

Focus group meetings to assess User’s needs 

PRC - Started design of new system (Phase I) 

LMI - Quality Review of PRC design documents 

Contracted Logicon Corp.for Reengineering Construction Phase 
(Phase II) 

Contracted KPMG for management support and IV& V 

Remediated code for Legacy System V2K 

Contracted with Averstar Corp. to assess, support and monitor 
the PMS V2K compliance efforts. 

Decision made - Make Legacy system Y2K compliant 

Continue construction of the Reengineered PMS 



101 


Mr. Callahan. It was our intention — we had hoped that that 
new system would he fully in place by December 1998 and Y2K 
compliant. Obviously, it was built to be Y2K compliant. But it was 
scheduled to be in place and operational by December 1998 and 
then we would be able to replace the current system. 

During the latter part of 1998, as we were looking at it, we un- 
derstood that there may be slippages. So we then in November 
1998 with our current system — that’s the system that operates, it’s 
ongoing today and it does all of these things that I mentioned ear- 
lier — we said we have to go back and look at its code and remediate 
its legacy code to be Y2K compliant. 

We did that in November; the code has been fully remediated, 
the code itself and the current operating system is Y2K compliant. 
But it has to go through further testing and certification through 
an independent contractor. At that time we also contracted with 
the Avistar Corp. and said, look, this is where we are, we’ve got 
to remediate it, we want to do two things. We want to be Y2K com- 
pliant as fast as possible, and then, second, we want to have for 
the future as a business case a better payment management sys- 
tem. 

They looked at where we were, both on the remediation of the 
legacy code system and this new reengineered payment manage- 
ment system, and gave us the report which basically says what you 
should do is, first of all, devote all of your current efforts between 
now, and they estimate June and they have a detailed timeline, et 
cetera, to make sure that the current system which you’ve remedi- 
ated, the legacy code system, will be fully Y2K compliant. 

However, at the same time or after, as you finish that up, you 
should not forego developing a new reengineered system. They felt 
that the code that we had developed in that, not all were hardware, 
not all were conversions, et cetera, that it was a good business case 
to continue to proceed with. But they said, you can’t do that at the 
same time you’re doing all of this repair to the current system. But 
they said don’t give up on the business case, but put it second. 

That’s exactly what we intend to do, so that we will have a Y2K 
compliant system by June, the current system, and then hopefully, 
if everything works out right, we will have a second system that 
will be Y2K compliant. But, obviously, we would not move into that 
second system until, unless and until, it can be proven that there 
will be no disruption in service. 

And, again, we think the report that Avistar gave us was an ex- 
cellent roadmap. It will be provided to GAO. It’s candid. It says 
this is where you’ve been, and this is where you should go, and we 
intend to follow that as a roadmap and again we will provide it to 
the committee, and we will hold ourselves to the milestones that 
are provided in this independent report. 

Mr. Turner. I only raised it because it seems to me to be a very 
obvious example of how costly Y2K compliance has become, be- 
cause you never would have tried to remediate the legacy system 
had we not been faced with Y2K. 

Mr. Callahan. Absolutely. 

Mr. Turner. It might be interesting if you could share with us, 
if you have an estimate, of how much Y2K is going to end up cost- 
ing the Department of Health and Human Services. 
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[The information referred to follows:] 


Department of Health and Human Services 
Total Y2K Costs — Fiscal Years 1996 - 2000 
(As of April 2, 1 999) 


(Dollars in Thousands) 


FY1996 

FY1997 

FY 1998 

FY1999 

FY2000 

TOTAL 

$ 7,190 

$ 32,213 

$ 190,870 

$ 427,276 

$ 165,168 

$822,717 


Mr. Callahan. I can get you all the detailed fiscal information 
for the record. 

Mr. Horn. We will put that in the record at this point. 

Mr. Callahan. Last year’s emergency appropriation for Y2K was 
$3.2 billion, the Department request under that emergency supple- 
mental $285.3 million. We have received those requests, and in- 
deed we received another $93 million fairly recently which HCFA 
has requested for its second installment of emergency money. 

So at this point, we are approximately for 1999 around $372 mil- 
lion, with obviously the lion’s share of that being allocated to 
HCFA for its work on its internal and external systems. That is the 
top priority of the Department. 

Mr. Turner. One final question I want to ask Ms. DeParle. I 
know that you have made efforts to notify the providers, and you 
have sent out over 1 million letters to the providers. In fact, I don’t 
know, Mr. Chairman, if we have that in the record or not. 

Mr. Horn. Two million. 

Mr. Turner. It might be nice to place that letter in the record. 

Mr. Horn. Without objection. 

Ms. DeParle. It also went out to every Member of Congress. 

[The information referred to follows:] 
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DEPA,RTMENT OF HF.aLTH & HUMAN SERVICES 


January 12, 1999 


'•Vashitigton, D.C. 


20201 


Dear Health Care Partner; 

You have probably heard about the Year 2000 computer problem, or the “Y2K. bug." As a health 
care practitioner or institution, you need to be aware of how Y2K affects you and your patients. 
We all must do our pan so that Medicare and Medicaid beneficiaries continue to receive high 
quality care, and you or your institution continue to be paid accurately and promptly. 

The Year 2000 problem appears simple on the surfecs. Many computers and devices use only six 
digits to record dates. They may read 01-01-00 as January I, 1900, rather than January 1, 2000, 
Patient care services, systems, and devices that rely on dates, the age of the patient, and other 
calculations could be severely affected if corrections are not made in time. 

Even' business and organization that relies on computer systems or devices must address Y2K 
For all of us in the health care industry, it is a patient care issue as well as a business and technical 
problem, A.s Administrator of the Health Care Financing Administration (HCFA), I need to make 
sure you are aware of some key points: 

» HCFA wilt be ready to process acceptable claims. We have made substantial progress 
in correcting our own systems in recent months and, despite earlier concerns, we will be 
ready on time. We are confident that all Medicare claims processes will be ready and able 
to function come January 1 , 2000. so that you can be paid promptly 

» You must also be ready if you wish to be paid promptly. We can process your claims 
only if your systems are also able to function in the Year 2000. It is URGENT that you 
act NOW so your systems will be ready. Otherwise, you may not be able to receive 
prompt payment from Medicare, Medicaid, and virtualiy any other payer. 

» Your entire practice and facility must be ready. The Y2K problem could impact 
quality of care and patient safety. Patient management systems, clinical information 
systems, defibrillators and infusion pumps and other medical devices, even elevators and 
security systems all must be ready. 

We want to help you prepare for the Year 2000. Enclosed is a “Sample Provider Y2K Readiness 
Checklist” which you can use to assess what you need to do. You can find additional usefiil 
information at our \vww.hcfa-gov/Y2K web site. Infonnation on medical devices is available on 
the Food and Drug Administration’s www fda.gOv/cdrh/vr2000/vear2Q00-html web site. 

We are confident that HCFA will be ready, but we arc also maldng contingency plans so we can 
continue operations if unexpected problems occur. For those of you that rely on computer 
systems, wc believe the greatest risk Is that your systems will not be able to bill for services, 
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You need ti> make sure vou will be ready for the Year 2000 And. like us. you need 10 mafco 
concingency pian.s for vour critical operations. These should incus especially on as.suring saleir 
for your patients who are reliant on etiuipment and devices comtiining embedded chips, in 
addition, you need to assure your ability to generate bills and manage accounts receiv abies. and 
assure essential services and supplies are maintained. Your patients and your business may 
depend on this. 

What can you do to avoid potential Y2K pitfalls? There are key steps you can take to became 
Y2K ready; 

Become aware of how the Year 2000 can affect your systems. Anything that depends on a 
microchip or date entry could be affected. Don’t forget to identify those organizations that > 
depend on or who depend on you, List everything and identify your mission critical item.s. 
namely, those you cannot live without. 

/‘Ia'.vc.v.v the readiness of everv'ihing on your list. You can do this by contacting your hardware oi 
software vendors or accessing key information from various web sites. Don't forget your 
maintenance and service contractors. If youF particular software program or form is not 'i «K 
ready, you need to decide whether you should invest in an upgrade or replacement. 

Update or replace systems, .software programs, and devices you decide arc critical for your 
business continuity, 

Test your existing and newly purchased systems and software. Do not assume that a sysiern or a 
program is Y2K ready just because someone said it is Test to make sure. During this process, 
keep track of your test plans and outputs in case a problem surfaces later. If you are not already 
using compliant electronic claim formats, consider testing your electronic data interchanges (f-Dl) 
with one or more of your payers, including Medicare. This will ensure that your payer can accept 
your EDI transactions, especially claims. Medicare can now accept claims with eight digit date 
formats. 

Develop business contingency (continuity) plans in the event something goes wrong. Kocu.s on 
the things that would be most problematic for you and your patients. 

The enclosed checklist may also be helpful. It is only meant to be a guide and should not be 
considered alMnclusive. 

Medicare beneficiaries are counting on all of us to meet the Year 2000 challenge. We will be 
ready. Now you need to do your part to be sure that you will continue to be paid as beneficiaries 
arc assured that they will continue to receive the health care they have come to depend on. 

Sincerely, 

A 

Nancy- Ann Min DeParle 


Enclosure 
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Mr. Horn. Let me say, if I might, to my colleague, if you want 
a Member of Congress to read it, put on it “personal and confiden- 
tial” and it will go in. Otherwise it is in the box of junk mail. I am 
one of the rare ones that reads all of that stuff every 2 weeks. 

Ms. DeParle. It came out in early January, so I was hoping 
maybe during the recess there would be a little more time to look 
at things. I was hoping some of you might use that information in 
your newsletters that I know you send to district folks. 

Mr. Turner. I see my time has expired. One subject I wanted to 
touch upon briefly, I wanted to get your assessment of the risk that 
we face in the biomedical equipment area. I know you have made 
some efforts to try to get the biomedical equipment manufacturers 
to notify all the providers regarding Y2K problems. But how do you 
personally assess that risk? That is one that greatly concerns me, 
particularly being from a rural area, where we have a lot of old 
equipment in rural hospitals. What is your assessment and what 
do you think you can still do to minimize that? 

Ms. DeParle. I have focused on the claims processing and pay- 
ment systems. That is what the Health Care Financing Adminis- 
tration does. I think Dr. Callahan can give you a better answer on 
that. 

Mr. Callahan. The Federal Food and Drug Administration is 
the agency within the Department that has to take that task on 
you are so concerned about. I do know they have been requested 
by the full committee for a variety of questions and answers related 
to the biomedical situation that those will be forthcoming, I believe 
in the next day or so, and we would like to provide those to you 
for the record. 

Let me say in general, however, the FDA has moved aggres- 
sively, along with other partners in the government, the Veterans 
Administration and others, to put up on a Website the Y2K compli- 
ance aspects of biomedical devices. 

But in addition, what is also important. Congressman Turner, as 
you know, is that each hospital and health care provider that has 
biomedical equipment has to go in and do an inventory of that 
equipment. They have to know what equipment they have on hand. 

For example, the Indian Health Service, under the jurisdiction of 
the Department, has completed its total inventory, as I understand 
it, of all the biomedical equipment that they have in their hos- 
pitals. They are matching that information against the FDA 
Website and working, again, with an independent contractor to de- 
termine what of that biomedical equipment is not Y2K compliant, 
and then they are moving immediately to buy or replace that bio- 
medical equipment. 

I just mention this, because this gets back to the point that Ad- 
ministrator DeParle mentioned. It is absolutely essential that the 
hospitals and the clinics and our community health centers, and 
again our Indian Health Service, for example, get out there and do 
this work themselves. 

We cannot, the Federal Government, cannot go in and do an in- 
ventory for them. They have to do it. Once they do it, we feel we 
will have sufficient information against which they can assess their 
biomedical situation. 
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Second, they have to get with their vendors too. They have to say 
I have this biomedical equipment, get on the phone with the ven- 
dors and ask is this Y2K compliant. I would ask them to test it. 
So it is a big job, and we have a central role to play in it, but it 
is also important for the providers to do their work. 

Mr. Turner. Thank you. 

Mr. Horn. Now I yield 5 minutes to the vice chairman of the 
Subcommittee on Government Management, Information, and 
Technology, Mrs. Biggert of Illinois. 

Mrs. Biggert. Thank you, Mr. Chairman. 

Ms. DeParle, do you think that there is any concern on the part 
of providers that liability issues are impacting their progress, or ei- 
ther whether they are going to work harder to comply or whether 
just not to do anything, and that they might not have the same li- 
ability? Is this an issue? Are they concerned about liability because 
of failures of the programs? 

Ms. DeParle. Well, we have been mainly relying on outside as- 
sessments that have been done of provider readiness. There is a 
group called RX 2000 that we commissioned to do a study. The In- 
spector General at our Department has also done a targeted study 
of Medicare providers that I think she will be releasing shortly. 

I don’t know if that issue has come to the forefront as much as 
I do have some anecdotal evidence that some providers have been 
concerned. As I mentioned to the chairman, it was an issue for me 
personally about our contractors when I first said I wanted the con- 
tractors to sign a contract amendment. 

There is a lot of concern, there has been a lot of concern about 
liability. I hear it from, for example, managed care plans that I 
have talked to, that they are concerned about — we have asked 
them to sign a contract amendment certifying they are going to be 
ready to pay managed care payments. Some of them are concerned 
about it. 

I think that the work that this committee and the Congress have 
done in trying to alleviate some of those concerns has helped, but 
I think it is still an issue out there. 

Mrs. Biggert. Thank you. I might ask Mr. Callahan too, as far 
as the payment management system, are there implications with 
the contractor departments. You do all this for all the different 
Federal agencies like the Department of Labor and NASA. Are 
there implications for them as well as if there are payments within 
your payment management system? 

Mr. Callahan. Again, a couple of points. We are very confident 
that, given the information I have mentioned to you earlier, we will 
be fully compliant with the legacy payment management system in 
June of this year. At the same time, we will also, as we have, we 
will provide you with the contingency plans that will ensure that 
all the grantees, whether they are in our own Department or out 
in the States or localities, will receive their money on time. 

There may be an issue, for example, on a contingency plan, as 
I mentioned to you earlier since the payment management system 
is just in time payment, if you will. It helps prevent a float. That 
is, we don’t give money to the States that they don’t spend that we 
could have earned interest on. 
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But obviously, if we get to a point where we have to have some 
contingency plans and maybe deliver payments in less than just in 
time, we may have to suggest waiving some of the provisions of the 
Cash Management Act. But I think we will know exactly once the 
2000 appropriations are passed exactly what all these agencies will 
need by way of grants, and we will make sure that they get those 
grants. 

Mrs. Biggert. Thank you. Mr. Willemssen, do you see this as a 
growing concern? 

Mr. Willemssen. Yes. It has been a growing concern. It is a con- 
cern that was attempted to be addressed with the Readiness Dis- 
closure Act that was passed late last year. I think this spring there 
will have to be a reassessment of the success of that act, and if in- 
deed it has allowed more disclosure of information. One thing we 
will be particularly looking at is Mr. Koskinen’s early April report 
on the readiness of all the key sectors in our country. To the extent 
that we begin to see much more detailed rich data on the readiness 
of those sectors, I think that can be used as a measure of the suc- 
cess of that act. To the extent we do not see that, then I think 
there will need to be a reassessment of whether additional legisla- 
tive action is necessary. 

Mrs. Biggert. Thank you. Thank you, Mr. Chairman. 

Mr. Horn. Thank you. I want to go to a very broad question, and 
I need to know who is the senior one in chronology in the Depart- 
ment. Mr. Secretary, when did you join HHS? 

Mr. Callahan. I joined in May 1995 and was confirmed in Au- 
gust 1995. 

Mr. Horn. Well, you are all innocent, but I am going to put the 
question anyhow. Social Security realized there was a real problem 
with the year 2000 back in 1989. When we were drafting Medicare, 
Social Security was the model which was used to draft Medicare. 
The Secretary was involved, the Commissioner of Social Security. 
Social Security in the sixties was regarded as the best managed 
agency in Washington, DC. I think it still has a lot of that reputa- 
tion. 

But I am curious if maybe you just know anecdotally, when So- 
cial Security, which was then under HHS, started doing this, why 
wasn’t there somebody in Medicare, and this is long before the cur- 
rent Administrator’s tenure, but why didn’t somebody say gee, we 
ought to do that too? 

Mr. Callahan. Well, I can’t answer that question directly and 
fully, but let me offer one observation. Social Security and HCFA 
are really two different organizations, as you know. 

Mr. Horn. Right. 

Mr. Callahan. Social Security, to their credit, retains a large di- 
rect service delivery structure through their offices, they retain 
probably one of the best information technology work forces inside 
their agency. I had the pleasure of working with them. They are 
first rate people, and there is a critical mass of information tech- 
nology people that enables them to get the good marks that you 
give them. 

HCFA, on the other hand, has to rely, as Administrator DeParle 
has said, on contractors to do a lot of their work. This was some- 
thing that was established in legislation, and, as you know, we 
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have had discussions about the relationship between HCFA and its 
contractors. So I would just say they were two different organiza- 
tions. 

I would also offer the observation that Social Security had the 
structure and critical mass of people to succeed at a quicker rate 
on this, no matter when the decision was made, than possibly the 
Health Care Financing Administration, with no disrespect to the 
current Administrator or previous Administrators. 

Mr. Horn. Let me just try to focus in now, just to get in one 
place in the record the legacy payment management system. As I 
understand it, in November 1998 you said you would think the 
code was all remediated by that time, and I think you said they 
would be year 2000 compliant by June 1999. 

I guess I would ask the question of how much did the original 
system, which is still there until assured of the secondary system, 
reengineered though it might be to see that that is compliant, what 
are we talking about in dollars? 

Mr. Callahan. We have spent, it is my understanding, to reme- 
diate the code on the legacy-based system, that we have spent 
$850,000 on that remediation. We have now, on the basis of that, 
the Avistar report, which we are giving to the committee today, in- 
dicates with that code, that remediated code in place, they have 
given us the milestones and the particulars to go through the re- 
maining processes to make sure it is certified and implemented, 
and they estimate that it will take until June for us to do that. 

Mr. Horn. So the total cost, how about the total cost of the pay- 
ment management system? 

Mr. Callahan. The other system, the reengineered payment sys- 
tem that we want to eventually get to 

Mr. Horn. Well, are you saying that the total cost of the original 
system that you are still working with, you are saying that is 
$850,000? It sounds a little low to me. 

Mr. Callahan. That system has been in operation for a long pe- 
riod of time. 

Mr. Horn. What, 10 years? 

Mr. Callahan. I am not exactly sure, but probably at least 10 
years, or at least a large number of years. So there has been no 
structural work on that other than it operates on a day-to-day 
basis. But when we get to the situation of having the concern that 
the reengineered payment management system would not make 
the Y2K deadline, we went back and looked at that legacy code and 
had it remediated, and that has been remediated. That cost us 
$850,000 to do that. 

Mr. Horn. OK. But that is not the original cost of the system. 

Mr. Callahan. No. The original cost of that system, I will have 
to get that information for the record. 

[The information referred to follows:] 

The PMS system was developed over a five year period from 1979-1984 at a cost 
of approximately $8 million. 

The exact cost to have the factory remediate the legacy code was $594,323. 

Mr. Horn. If you could. What I am going to leave open is the 
questions we asked about this now and since you just gave us the 
document today, questions that we will send down to you and we 
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will put without objection, the whole bunch at the end of the hear- 
ing. But we will have it in one place. 

So now that we have got the secondary system that you are going 
to move to when you can be assured that it is compliant, what is 
the estimated cost on that? 

Mr. Callahan. We will supply that for the record, but to date 
we have spent $6.7 million on that since 1994. 

[The information referred to follows:] 

The estimated cost to have the system deployable is $10 million (in round num- 
bers) and includes the $6.7 million already expended. 

Mr. Horn. Since 1994. That is the secondary system. 

Mr. Callahan. Yes. 

Mr. Horn. OK. Now, was your original payment management 
system approved by the appropriate authorization committee and 
appropriations subcommittee? 

Mr. Callahan. I will have to get that information for the record. 

[The information referred to follows:] 

PMS was not the “original” grants payment system in HHS. It was a third-gen- 
eration system preceded by the Departmental Federal Assistance Financing System 
(DFAFS) and the NIH Grants Payment System (GPS). The GPS originated in the 
sixties and operated with funds appropriated for normal administrative activities. 
Therefore, there was no formal request of special appropriated funds for a “new” 
system. The funds for the PMS upgrade were included in our budget requests and 
were appropriated accordingly. 

Mr. Horn. I take it you billed your customers to try to cover the 
cost? 

Mr. Callahan. Yes. 

Mr. Horn. What kind of money are we talking about? 

Mr. Callahan. You mean our annual inflow? 

Mr. Horn. What is your annual revenue for serving people in the 
rest, the executive branch? 

Mr. Callahan. I will get that for the record, the actual dollar, 
but I will tell you the fees for this are extremely low, because in 
essence we provide not only the just in time service, but we rec- 
oncile the accounts so there is no Cash Management Improvement 
Act problems. That is, the agency doesn’t have to pay interest to 
the States or vice versa. 

[The information referred to follows:] 

The total revenue for FY98 was $9,076,927. 

Mr. Horn. There is $170 million a year flowing through that sys- 
tem, is that correct? 

Mr. Callahan. $165, I think it is, or $170. I will get the precise 
amount. 

[The information referred to follows:] 

The precise number is $166,710,740,000 or 166 billion. 

Mr. Horn. OK. Have you kept those records? Is that part of your 
accounting system? 

Mr. Callahan. Yes. 

Mr. Horn. Now, how different is it or how similar is it to the Fi- 
nancial Management Service within the Department of the Treas- 
ury and the center in New Orleans of the Department of Agri- 
culture that some other departments use? 
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Mr. Callahan. Vis-a-vis the Treasury system, it has additional 
functionalities, the current system and the future system have 
functionalities like Cash Management Improvement Act capabili- 
ties that the Treasury system does not have. There are other agen- 
cies right now that, for example, the Department of Education has 
its own grant payment management system. The Council of Chief 
Financial Officers has in response to State officials who don’t like 
all these different grant payment systems working, recommended 
that only two systems be used, the Treasury ASAP system and the 
HHS payment management system. So we have gone out and 
worked with each of the agencies. They will be making their 
choices over time. 

So at some point down the line, it appears that there will be only 
two payment management systems run by the Federal Govern- 
ment, the Treasury system and our system. 

Mr. Horn. Now, the Treasury system runs the Social Security 
checks, is that not correct? 

Mr. Callahan. Social Security 

Mr. Horn. Financial Management Service. 

Mr. Callahan. Yes, that goes to the Financial Management 
Service. I am not sure that is ASAP, which is their grant payment 
system. I have to check on that. 

Mr. Horn. I am just curious. So each Cabinet Secretary has a 
right to make a choice as to where they will get the best service? 

Mr. Callahan. Yes. 

Mr. Horn. Is some of that related to the actual cost? 

Mr. Callahan. Yes. 

Mr. Horn. Are you the cheapest deal in town? 

Mr. Callahan. We think we are the best deal in town. 

Mr. Horn. I know you think you are the best. The most reason- 
able rate that you charge. 

Mr. Callahan. Right. 

Mr. Horn. Well, we are interested in that, just to make sure it 
is on line. We are interested in the compliant bit, and I think if 
you can all agree on what is the appropriate test, we will know in 
the next round if something really was remediated. 

Mr. Callahan. Yes, sir. 

Mr. Horn. Let me just make a few comments. We have had some 
very fine testimony this morning that has clarified a number of 
things for us. The fact is, millions of American citizens rely on 
Health and Human Services and your very critical services. We all 
know that Medicare is just one of the key things in this society. 
When you think back what this country would be like if we hadn’t 
had Medicare established in 1965, you would realize that this is 
one of the major laws of the 20th century. 

We are going to continue to monitor the Department’s progress 
to develop the new system on the legacy system, and we will maybe 
have a future hearing on all of those types of operations in the ex- 
ecutive branch. 

However, I remain concerned about the Health Care Financing 
Administration’s external mission critical systems that were re- 
cently reported as being 2000 compliant. I am assuming GAO and 
you will get agreement on this by the next round, because to me 
“compliant” means compliant, not compliant with qualifications. 
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But I thank you both from the Department for your testimony, 
and I thank the General Accounting Office and all of your associ- 
ates for your testimony. I think we are making progress as a result 
of the cooperation we have had within the executive branch and 
with GAO. I think this morning, however, we still have a lot to do, 
and that from some of the questions Mrs. Morelia asked it is really 
a thing that both the legislative branch and executive branch have 
to do, which is get the word out to the people, so we don’t have a 
lot of corner cutters and book writers that are trying to scare the 
living daylights out of the American public. 

This is a solvable problem. You have shown, even though you 
have come to this late, but you certainly turned a lot of that agency 
around in terms of getting the remediation underway, and we ap- 
preciate that. That good word needs to go out. The more TV shows, 
radio shows, Q and A you can answer, and I know that is tough, 
that is very important, because every little bit helps. 

If there are no further questions from any of my colleagues, with 
that, this hearing is adjourned. 

The staff list I will put in the record. Just for the record, J. Rus- 
sell George, the staff director and chief counsel; Matt Ryan, to my 
left, senior policy director; Bonnie Heald, director of information; 
Mason Alinger, clerk; Paul Wicker, Kacey Baker and Richard 
Lukas, interns; Michelle Ash, minority counsel; Faith Weiss, minor- 
ity professional staff member and counsel; Earley Green, minority 
staff ssistant; and then the court reporters, Doreen Dotzler, Cindy 
Sebo and Bob Cochran, who is faithfully writing down to the last 
second. 

Thank you. Bob. 

[Whereupon, at 11:10 a.m., the subcommittee was adjourned.] 
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